Transmission and reception methods, communication devices, and local area networks

Abstract

The present disclosure relates to a method for transmitting data by a communication device over a communication channel, the method including, for each time cycle, the communication device determining a protected data frame based on data to be transmitted, and the communication device transmitting the protected data frame over the communication channel, each protected data frame including protected content determined by using an initialization vector, the initialization vector having a lifetime associated therewith, the lifetime being equal to or greater than a plurality of cycle periods, the initialization vector not being changed when the data to be transmitted is identical to data transmitted in a previous time cycle, provided that the lifetime of the initialization vector has not expired.

Description

[Technical Field]

[0001] The present disclosure relates to communication systems, and more particularly to a method and communication device for securing communications in a local area network (LAN), such as an industrial Ethernet-based LAN. [Background technology]

[0002] In a typical industrial network, communication devices are typically connected by a bus using a daisy-chain topology. Typically, a master communication device (typically a programmable logic controller (PLC)) transmits a data frame to a slave communication device, and each communication device that receives the data frame forwards the data frame to an adjacent communication device if it is not the recipient of the received data frame. In the reverse direction, each communication device can also transmit data frames to the master communication device. Data frames generated by a communication device located on the opposite side of the daisy-chain topology from the master communication device are forwarded by any intermediate communication devices up to the master communication device.

[0003] For example, data frames exchanged between communicating devices may be Ethernet data frames. In industrial networks, data frames may need to be exchanged with strict time delay requirements, such as every 30 microseconds (μs). Time-Sensitive Networking (TSN) is a set of IEEE 802.1 standard technologies defined to provide deterministic messaging within the standard Ethernet protocol. The key to providing on-time delivery of time-sensitive data frames is the IEEE 802.1Qbv standard. More specifically, the IEEE 802.1Qbv standard defines a time-aware scheduler designed to separate communications over an Ethernet communication channel into repeating time cycles of fixed duration. Within these time cycles, various time slices can be configured that can be assigned to traffic classes with different priorities. Such time slices can be viewed as virtual communication channels, enabling the separation of unconstrained background traffic from time-sensitive traffic.

[0004] FIG. 1 is a schematic diagram illustrating the time cycles and time slices on which the IEEE 802.1Qbv standard is based. In the example illustrated by FIG. 1, two time cycles are indicated by "Time Cycle #n" and "Time Cycle #n+1," respectively. Each time cycle includes two time slices indicated by "Time Slice #1" and "Time Slice #2," respectively. A guard band is provided after Time Slice #2 of each time cycle and before the start of Time Slice #1 of the next time cycle. For example, Time Slice #1 can be reserved for data frames tagged with Virtual Local Area Network (VLAN) priority 7 (defined by the IEEE 802.1Q standard), while Time Slice #2 can be used for data frames tagged with VLAN priorities 0 to 6.

[0005] Traditionally, industrial fieldbus networks have been isolated LANs, meaning they are not connected to other networks, especially the Internet, and therefore are practically not exposed to external threats and offer little support for security mechanisms.

[0006] However, with the advent of protocols that allow time-critical and non-time-critical data frames to coexist on the same communication channel, such as those defined by the IEEE 802.1 TSN set of standards, industrial networks can also be used for applications with less stringent time delay requirements. Thus, new communication devices with less stringent time delay requirements (e.g., other than the master PLC and its slave communication devices) can be added and connected to the industrial network.

[0007] As these new communication devices are connected, for example if one or more of the new communication devices can connect to the Internet, the industrial network can no longer be considered a strictly isolated network and may be exposed to new threats.

[0008] For example, in the case of an industrial network with communication devices connected by a bus using a daisy chain topology, if one of those communication devices is compromised, possible attacks include: Eavesdropping: An attacker could use a corrupted communication device to intercept data frames relayed by the corrupted communication device; however, the data exchanged between, for example, a master PLC and its slave communication devices is usually very low-level and difficult for an attacker to exploit by itself. Data Frame Injection: Using a corrupted communication device, an attacker can inject malicious data frames into the communication channel, causing malfunction of the master PLC and its slave communication devices, and in some cases serious hardware damage. Data Frame Replay: An attacker could use a corrupted communications device to inject malicious data frames crafted from legitimate data frames sent by an uncorrupted communications device and intercepted by the corrupted communications device. - Data frame tampering or deletion: An attacker may use a damaged communication device to tamper with or delete relayed data frames, causing the master PLC and its slave communication devices to malfunction.

[0009] Therefore, to be able to make industrial networks more robust against all or some of the above mentioned attacks, it is necessary to introduce security mechanisms into industrial networks that have traditionally been designed as isolated networks, but such security mechanisms must be introduced while ensuring that strict latency requirements can still be met, preferably with limited modifications introduced to existing communication devices. Summary of the Invention [Problem to be solved by the invention]

[0010] The present disclosure aims to improve the situation. In particular, the present disclosure aims to overcome at least some of the limitations of the prior art mentioned above by proposing a solution for introducing security mechanisms into industrial networks. In preferred embodiments, the present disclosure aims to propose a solution that can be deployed even on existing communication devices, for example by means of a software update. [Means for solving the problem]

[0011] To this end, according to a first aspect, the present disclosure relates to a method for transmitting data by a communication device over a communication channel shared by a plurality of communication devices, wherein communication on the communication channel is organized according to a time cycle repeated with a predetermined cycle period, and the communication device is required to transmit data for each time cycle, and if there is no new data to be transmitted, the data to be transmitted is repeated from one time cycle to a subsequent time cycle. determining, by the communication device, a protected data frame based on data to be transmitted; transmitting, by a communication device, a protected data frame over a communication channel; Includes.

[0012] Also, each protected data frame includes protected content determined by using a predetermined initialization vector, the initialization vector having an associated lifetime corresponding to a maximum duration that the initialization vector can be maintained without being changed, the lifetime being equal to or greater than a predetermined multiple of the cycle period. The initialization vector is not changed when data to be transmitted in a current time cycle is identical to data transmitted in a previous time cycle, unless the lifetime of the initialization vector has expired.

[0013] Therefore, this disclosure considers the case of periodic transmission, i.e., when a communication device (e.g., a master PLC) needs to transmit data every time cycle. For example, if the time cycle repeats with a cycle period of 100 μs, the communication device needs to transmit data every 100 μs. The communication device may not have new data to transmit every cycle period, and if there is no new data, the communication device retransmits the data transmitted in the previous time cycle. Therefore, if the cycle period is very short (e.g., 30 μs), the communication device may have to retransmit the exact same data several times.

[0014] At each time cycle, the communication device determines the protected content based on an initialization vector. Similar to traditional cryptographic algorithms, this initialization vector is an input used to initialize the cryptographic algorithm. The initialization vector may include, for example, a random or pseudo-random number, or any number that can be at least partially updated to change the state of the cryptographic algorithm. The protected content may include, for example, a signature that authenticates the communication device's encrypted data, which is determined by encrypting the data to be transmitted. The protected content may be computed using any cryptographic algorithm known to those skilled in the art. The communication device then generates a protected data frame containing the protected content and transmits it over the communication channel.

[0015] To limit the computational complexity required to determine the protected content and facilitate determining the protected content even in very short cycle periods, the initialization vector is updated only when the data to be transmitted in the current time cycle differs from the data transmitted in the previous time cycle. Therefore, because the initialization vector is not necessarily updated in each time cycle, the cryptographic algorithm used to calculate the protected content does not need to be executed in each time cycle, but only when the data to be transmitted is updated. In industrial networks with very short cycle periods, such as 30 μs, the same data can be repeated multiple times so that the same protected content can be used over several time cycles without having to be recalculated from scratch in each time cycle, thereby significantly limiting the computational complexity associated with updating the protected content in each time cycle. This limited computational complexity allows the protected content to be determined in software, making the method applicable to existing industrial networks through a simple software update without hardware modifications.

[0016] However, to prevent the same protected content from being repeated too many times and to increase robustness against replay attacks, the initialization vector has a lifetime that forces the communication device to repeatedly change the initialization vector even when the data to be transmitted in the current time cycle is identical to the data transmitted in the previous time cycle. This lifetime may be equal to N cycle periods, for example, for N≧2, such that the initialization vector (and the protected content computed from it) cannot remain unchanged for longer than N consecutive time cycles. For example, N≧3 or N≧5.

[0017] In particular embodiments, the transmission method may further comprise one or more of the following optional features, considered either alone or in any technically possible combination:

[0018] In certain embodiments, the secured content of the secured data frame of the previous time cycle is repeated in the current time cycle without recalculating the secured content in response to determining that recalculating the secured content of the current time cycle would result in the same secured content as the previous time cycle.

[0019] In certain embodiments, determining the protected content of the protected data frame is performed by software.

[0020] In a particular embodiment, each time cycle includes at least a first time slice and a second time slice, the first time slice being for communicating data having higher timing constraints than data communicated during the second time slice, and the protected data frame being transmitted during the first time slice.

[0021] In certain embodiments, a protected data frame is obtained by providing protected content to an industrial Ethernet protocol stack.

[0022] In certain embodiments, the protected data frame is obtained by providing the protected content to an Industrial Ethernet Time Sensitive Networking (TSN) protocol stack.

[0023] In certain embodiments, the protected contents of each protected data frame are further determined by using a predetermined symmetric key.

[0024] In certain embodiments, the protected content includes signed and / or encrypted data.

[0025] In certain embodiments, the protected data frame includes all or part of an initialization vector.

[0026] In certain embodiments, the lifetime of the initialization vector is greater than or equal to N times the cycle period, where N > 2. In preferred embodiments, N > 5.

[0027] According to a second aspect, the present disclosure provides a method for receiving a data frame by a communication device, the data frame being transmitted by another communication device by using the transmission method according to any one of the embodiments of the present disclosure, and the communication device processes protected content included in the protected data frame to authenticate the other communication device and / or decrypt data included in the protected data frame. The receiving method includes: receiving a protected data frame in a current time cycle; extracting protected content from the protected data frame of the current time cycle; In response to detecting that the protected content extracted from the protected data frame of the current time cycle is identical to the protected content extracted from the protected data frame received in the previous time cycle and detecting that the initialization vector has not expired, reusing a result of processing the protected content of the protected data frame of the previous time cycle without processing the protected content of the protected data frame of the current time cycle; The present invention relates to a receiving method, including:

[0028] In particular embodiments, the receiving method may further comprise one or more of the following optional features, considered either alone or in any technically possible combination:

[0029] In certain embodiments, the processing of the protected content is performed by software.

[0030] According to a third aspect, the present disclosure relates to a computer program product comprising instructions that, when executed by at least one processor, configure the at least one processor to perform the transmitting method and / or the receiving method according to any one of the embodiments of the present disclosure.

[0031] According to a fourth aspect, the present disclosure relates to a computer-readable storage medium comprising instructions that, when executed by at least one processor, configure the at least one processor to perform the transmitting method and / or the receiving method according to any one of the embodiments of the present disclosure.

[0032] According to a fifth aspect, the present disclosure relates to a communication device comprising at least one processor and at least one memory and configured to perform the transmitting method and / or the receiving method described in any one of the embodiments of the present disclosure.

[0033] According to a sixth aspect, the present disclosure relates to a local area network (LAN) comprising a plurality of communication devices described in any one of the embodiments of the present disclosure, at least some of the communication devices being connected to each other according to a daisy chain topology.

[0034] The invention will be better understood on reading the following description, which is given by way of example and in no way limiting, and is made with reference to the figures. [Brief explanation of the drawings]

[0035] [Figure 1] FIG. 1 is a diagram illustrating an example of a time cycle and a time slice according to the IEEE 802.1Qbv standard. [Figure 2] FIG. 1 is a schematic diagram of a communication device. [Figure 3] FIG. 2 represents the main steps of an exemplary embodiment of a transmission method. [Figure 4] FIG. 4 represents the main steps of another exemplary embodiment of a transmission method. [Figure 5] FIG. 1 is a schematic diagram of the various protocol layers implemented, including the security sublayer. [Figure 6] FIG. 2 represents the main steps of an exemplary embodiment of a receiving method. [Figure 7] FIG. 2 is a schematic diagram of an example of a signature calculation using a symmetric key. [Figure 8] FIG. 1 is a schematic diagram of an example of an Industrial Ethernet TSN protected data frame. DETAILED DESCRIPTION OF THE INVENTION

[0036] In the figures, the same reference numerals indicate the same or similar elements. For clarity, elements shown are not to scale unless expressly specified otherwise.

[0037] Additionally, the order of steps depicted in the figures is provided for illustrative purposes only and is not intended to limit the present disclosure, which may also be applicable when the same steps are performed in a different order.

[0038] FIG. 2 schematically illustrates one exemplary embodiment of a communication device 20 that can be connected to a local area network (LAN), such as an industrial LAN.

[0039] As shown in FIG. 2, the communication device 20 comprises an application unit 21 and a communication unit 22 .

[0040] The communication unit 22 is adapted to transmit and receive data over the communication channel according to at least one wired communication protocol. More specifically, communication over the communication channel is organized according to a time cycle that repeats with a predetermined cycle period T0. That is, a new time cycle is initiated every T0. The communication unit 22 is configured for periodic transmission. That is, the communication unit 22 is configured to transmit data over the communication channel at a precise time every time cycle, even if the transmission of data means repeating previously transmitted data. In a preferred embodiment, the communication unit 22 implements at least one industrial Ethernet protocol, i.e., a protocol that relies on standard Ethernet protocols in industrial environments and provides determinism and real-time control. The industrial Ethernet protocol and the standard Ethernet protocols underlying the industrial Ethernet protocol are collectively referred to as an "industrial Ethernet protocol stack." Most industrial Ethernet protocols are proprietary, and relying on standard Ethernet protocols introduces a degree of interoperability. For example, the communication unit 22 complies with IEEE standards such as the 10BASE-T / 100BASE-TX IEEE 802.3 standard. The communication unit 22 may support the IEEE 802.1Q standard for VLAN tag detection and / or the IEEE 1588-2008 standard for high-precision network clock synchronization or gigabit speeds. In a preferred embodiment, the communication unit 22 may support IEEE TSN extensions such as the IEEE 802.1Qbv standard. Examples of industrial Ethernet protocols include Ether-CAT™, EtherNet / IP™, PROFINET™, POWERLINK, SERCOS™ III, CC-Link™ IE, and Modbus™. In this disclosure, industrial Ethernet protocols that rely on TSN extensions such as the IEEE 802.1Qbv standard are referred to as Industrial Ethernet TSN (IE-TSN) protocols. The protocol CC-Link IE TSN (CC-IE-TSN) is a non-limiting example of the IE-TSN protocol.The combination of the IE-TSN protocol and the underlying standard Ethernet protocols (including TSN extensions) is called the "Industrial Ethernet TSN protocol stack."

[0041] The application unit 21 implements the application layer, which uses the services of the communication unit 22 and thereby generates data to send to another communication device 20 over a communication channel and processes data received from another communication device 20 over a communication channel. In an industrial LAN where multiple communication devices 20 are connected by communication channels, each communication device 20 can be, for example, one of a PLC, a sensor, an actuator, a human machine interface (HMI), and the application layer depends on the type of communication device 20 considered.

[0042] Each of the communication unit 22 and the application unit 21 may include, for example, one or more processors and one or more memories. The one or more processors may include, for example, a central processing unit (CPU) or a digital signal processor (DSP). The one or more memories may include any type of computer-readable volatile and non-volatile memory (such as a magnetic hard disk, a solid-state disk, an optical disk, or an electronic memory). The one or more memories may store a computer program product (software) in the form of a set of program code instructions executed by the one or more processors to implement all or some of the steps of the transmitting method 30 and / or the receiving method 60. Alternatively, or in combination thereof, one or both of the communication unit 22 and the application unit 21 may include one or more programmable logic circuits (such as FPGAs, PLDs, etc.), and / or one or more application-specific integrated circuits (ASICs), and / or a set of discrete electronic components, etc., that implement all or some of the steps of the transmitting method 30 and / or the receiving method 60. In some cases, all or some of the underlying hardware resources may be shared by the communication unit 22 and the application unit 21. For example, the same processor and the same memory may be used by both the communication unit 22 and the application unit 21 of the communication device 20 .

[0043] In a preferred embodiment, the communication unit 22 may be implemented exclusively in hardware (FPGA, PLD, ASIC), in particular to support very short cycle periods (less than 100 μs, e.g., 30 μs), while the application unit 21 may be implemented in software (i.e., program code instructions executed by one or more processors). The application unit 21 and the communication unit 22 may exchange data, for example, via a shared memory.

[0044] In a preferred embodiment, all or some of the communication devices 20 may be connected according to a daisy chain topology, although other topologies are contemplated by this disclosure.

[0045] FIG. 3 illustrates in schematic form the main steps of an exemplary embodiment of a transmission method 30 for protecting periodic transmissions of a communication device 20 in a LAN, such as an industrial LAN.

[0046] As described above, the present disclosure relies on conventional cryptographic algorithms to protect data to be transmitted by communication device 20. In particular, an initialization vector is used to determine protected content (e.g., corresponding to a signature authenticating communication device 20 and / or encrypted data obtained by encrypting the data to be transmitted) to be included in a protected data frame transmitted over a communication channel. On the other hand, the present disclosure utilizes the uniqueness of periodic transmissions to introduce such a security mechanism while limiting the required computational complexity. In particular, while conventional security mechanisms require that the initialization vector be updated with each transmission, the present disclosure does not require updating the initialization vector with each transmission (i.e., with each time cycle), so that the cryptographic algorithm does not need to be executed every time cycle, i.e., with a cycle period T0.

[0047] As shown in Fig. 3, the transmission method 30 comprises a step S30 of retrieving data to be transmitted to another communication device 20. This data is generated by the application layer (implemented by the application unit 21). The data to be transmitted retrieved during step S30 therefore corresponds to application data. Since the communication device 20 performs periodic transmissions, the data to be transmitted in the current time cycle may be identical to the data transmitted in the previous time cycle. Indeed, if no new data is available for transmission, the data transmitted in the previous time cycle is repeated in the current time cycle.

[0048] In the example shown in FIG. 3, the communication device 20, for example the application unit 21, evaluates during step S31 whether the data to be transmitted in the current time cycle is identical to the data transmitted in the previous time cycle.

[0049] If the data to be transmitted in the current time cycle is different from the data transmitted in the previous time cycle (reference symbol S31a in FIG. 3), the transmission method 30 proceeds to step S32 of updating the initialization vector. For example, if the initialization vector includes a random or pseudo-random number, updating the initialization vector includes selecting another random or pseudo-random number using a (pseudo-)random number generator. Alternatively, or as a combination thereof, the initialization vector may include a counter that is incremented (or decremented) when updated. In some cases, the initialization vector may also include a static portion that is not updated (such as the address of the sending communication device 20 or the address of the destination communication device 20, or a combination thereof) and a dynamic portion that can be updated.

[0050] If the data to be transmitted in the current time cycle is identical to the data transmitted in the previous time cycle (see reference symbol S31b in FIG. 3), the transmission method 30 proceeds to step S33, where it evaluates whether the lifetime of the initialization vector has expired. In practice, to prevent the initialization vector from remaining unchanged for too many time cycles, a lifetime is associated with the initialization vector, representing the maximum duration for which the initialization vector can remain unchanged. This lifetime is equal to or exceeds a predetermined multiple of the cycle period T0. For example, the lifetime is equal to N×T0, where N is an integer greater than or equal to 2, to ensure that the initialization vector can remain unchanged for at least two time cycles (preferably, three or more time cycles), provided that the data to be transmitted has not changed since the previous time cycle. For example, N≧3 or N≧5.

[0051] If the lifetime of the initialization vector has expired (reference symbol S33a in FIG. 3), the initialization vector needs to be updated, and step S32 is executed. If the lifetime of the initialization vector has not expired (reference symbol S33b in FIG. 3), the initialization vector is not updated.

[0052] For example, each time the initialization vector is updated (during step S32), a counter LT is set to N (LT←N), and step S33 first decrements the counter LT (LT←LT-1) before evaluating whether the lifetime has expired. If LT=0 in step S33, the lifetime can be considered expired.

[0053] 3, the transmission method 30 then proceeds to step S34 of determining the protected content by using the initialization vector. The protected content may, for example, comprise a signature authenticating the communication device 20 and / or encrypted data (in which case the protected content is also determined based on the data to be transmitted). Step S34 is preferably performed by the application unit 21. As will be explained in more detail below, determining the protected content corresponds either to calculating the protected content by executing a cryptographic algorithm or, when possible, to repeating the protected content transmitted in a previous time cycle.

[0054] As mentioned above, determining the protected content can use any cryptographic algorithm known to those skilled in the art. In a preferred embodiment, the protected content is further determined by using a predetermined symmetric key, i.e., a key known to both the sending communication device 20 and any receiving communication devices 20. The symmetric key can be distributed to communication devices 20 that need to send and / or receive the protected content via conventional key distribution methods, for example, by establishing a protected channel between the communication device 20 and a trusted key server. Symmetric key distribution is outside the scope of this disclosure. Alternatively, the symmetric key may be periodically updated iteratively, for example, using a key update period longer than the lifetime of the initialization vector (preferably significantly longer than this lifetime, e.g., several hours or more). Thus, in some cases, the protected content may differ between time cycles due to symmetric key updates even if the initialization vector remains unchanged.

[0055] 3, the transmission method 30 then proceeds to step S35 of determining a protected data frame containing the protected content. If the protected content does not include encrypted data, the data to be transmitted, generated by the application layer during step S30, is also included in the protected data frame. The protected data frame is then transmitted over the communication channel during step S36. The step S35 of determining the protected data frame and the step S36 of transmitting the protected data frame are performed by the communication unit 22 of the communication device 20.

[0056] The steps of the transmission method 30 shown in FIG. 3 are repeated in each time cycle so that at least one protected data frame is to be transmitted over the communication channel in each time cycle.

[0057] FIG. 4 schematically illustrates the main steps of another exemplary embodiment of transmission method 30. All steps described with respect to FIG. 3 are included in FIG. 4, but in a slightly different order that alters the way lifetimes are handled. As shown in FIG. 4, transmission method 30 includes step S30 of retrieving data to be transmitted. Then, transmission method 30 proceeds to step S33 of evaluating whether the lifetime has expired. If the lifetime has expired (reference sign S33a in FIG. 4), step S32 of updating the initialization vector is performed. If the lifetime has not expired (reference sign S33b in FIG. 4), transmission method 30 proceeds to step S31 of evaluating whether the data to be transmitted in the current time cycle is identical to the data transmitted in the previous time cycle. If the data to be transmitted in the current time cycle is different from the data transmitted in the previous time cycle (reference sign S31a in FIG. 4), step S32 of updating the initialization vector is performed. If the data to be transmitted in the current time cycle is identical to the data transmitted in the previous time cycle (reference sign S31b in FIG. 4), the initialization vector is not updated. The transmission method 30 then includes step S34 of determining the protected content, step S35 of determining the protected data frame, and step S36 of transmitting the protected data frame over the communication channel. For example, the counter LT may be set to N (LT←N) only when the initialization vector is updated (during step S32) if the lifetime has expired. Thus, the counter LT is not set to N if the initialization vector is updated because the data to be transmitted in the current time cycle is different from the data transmitted in the previous time cycle. Similarly, step S33 first decrements the counter LT (LT←LT−1) before evaluating whether the lifetime has expired, and if LT=0, the lifetime is considered to have expired. In the embodiment of FIG. 4, the initialization vector is thus updated periodically every N time cycles, and may also be further updated when the data to be transmitted in the current time cycle is different from the data transmitted in the previous time cycle.Therefore, the embodiment of FIG. 3 requires fewer initialization vector updates than the embodiment of FIG.

[0058] As described above, the step S35 of obtaining a protected data frame and the step S36 of transmitting the protected data frame are performed by the communication unit 22 of the communication device 20. Without the security mechanism introduced in the present disclosure, the communication unit 22 would process protocol data units (PDUs) generated by the application layer and primarily containing data to be transmitted. According to the present disclosure, the PDUs to be processed contain protected content and, if the protected content does not contain encrypted data, may also contain data to be transmitted. Therefore, the interface to the communication unit 22 does not actually change to implement the proposed security mechanism, but only needs to process PDUs of slightly larger size. Therefore, in a communication device 20 in which the communication unit 22 is accelerated by hardware (FPGA, ASIC), the present solution does not require hardware modifications to the communication unit 22.

[0059] This is due to the fact that security mechanisms are implemented in higher protocol layers so that the lower protocol layers are not affected by the implementation of the security mechanisms, which is particularly convenient when the lower protocol layers are accelerated by hardware (FPGA, ASIC). Indeed, as shown in FIG. 5, security mechanisms (and in particular handling of protected content) are implemented by a security sublayer 51 located between, for example, an application layer 50 that generates data to be transmitted (and can receive data from other communication devices 20) and a periodic transport protocol stack 52, which can be, for example, an industrial Ethernet (TSN) protocol stack. The periodic transport protocol stack 52 generates protected data frames to be transmitted by using PDUs containing the protected content, and extracts the protected content from the protected data frames received on the communication channel, which is forwarded to the security sublayer 51. The security sublayer 51 can be bypassed in some cases. Indeed, there are some cases in which security mechanisms are not used. For example, in FIG. 1, it is possible to use protected data frames only in time slice #1, in which case protected content is not included in data frames transmitted in time slice #2.

[0060] The initialization vector (or symmetric key, if used) is not necessarily updated in each time cycle. Therefore, the cryptographic algorithm used to calculate the protected content does not need to be executed in each time cycle, but is executed only when the cryptographic algorithm may result in protected content that differs from the protected content included in the protected data frame transmitted during the previous time cycle. Therefore, the protected content needs to be calculated by executing the cryptographic algorithm only when the initialization vector is updated (i.e., the data to be transmitted has changed or its lifetime has expired) and, if a symmetric key is used, when the symmetric key is updated. In other cases (when there is no update of the initialization vector and no update of the symmetric key, if a symmetric key is used), determining the protected content in step S34 can be equivalent to retrieving the previous protected content transmitted in the protected data frame of the previous time cycle. With a very short cycle period, for example 30 μs, it is not necessary to actually calculate the protected content in most cases, and the previous protected content can be repeated. Therefore, the computational complexity required to determine the protected content can be limited and can be adapted for software implementation. Even if a longer cycle period requires the actual calculation of the protected content over more time cycles than a shorter cycle period, there is more time available for this calculation and so this is also suitable for software implementation. Thus, step S34 of determining the protected content can be performed entirely in software, in which case the method can be introduced in existing industrial networks by a simple software update of the communication device 20 without any hardware changes.

[0061] 6 schematically illustrates the main steps of an exemplary embodiment of a method 60 for receiving data by a receiving communication device 20. The data is transmitted by the transmitting communication device 20 by using the transmission method 30 according to any one of the embodiments of the present disclosure. Accordingly, the receiving communication device 20 receives a protected data frame on a communication channel, which includes protected content as described above. The receiving communication device 20 processes the protected content to authenticate the transmitting communication device 20 (if the protected content includes a signature) and / or decrypt the data (if the protected content includes encrypted data). However, since the protected content may remain unchanged between time cycles, processing is not necessarily performed every time cycle when the results of processing the protected content received in the previous time cycle can be reused, thereby also reducing the computational complexity at the receiving side.

[0062] As shown in FIG. 6, the receiving method 60 includes a step S60 of receiving a protected data frame in a current time cycle on a communication channel and a step S61 of extracting protected content from the protected data frame in the current time cycle, and these steps are performed by the communication unit 22 of the receiving communication device 20.

[0063] As shown in FIG. 6, the receiving method 60 then proceeds to step S62, where it evaluates whether the protected content extracted from the protected data frame of the current time cycle is identical to the protected content extracted from the protected data frame received in the previous time cycle.

[0064] If the protected content is different from the protected content of the previous time cycle (reference symbol S62a in FIG. 6 ), the receiving method 60 proceeds to step S63, where the security sublayer 51 processes (by means of the security sublayer 51) the protected content extracted from the protected data frame received in the current time cycle to authenticate the transmitting communication device 20 and / or decrypt the data. If an initialization vector is not included in the protected data frame, the receiving communication device 20 updates its initialization vector to keep it synchronized with the initialization vector of the transmitting communication device 20, and processes the protected content using the updated initialization vector. If a symmetric key is used, updating the symmetric key may reveal different protected content. Thus, the receiving communication device 20 can process the protected content using the updated symmetric key and its previous (unupdated) initialization vector, and also using the updated symmetric key and updated initialization vector. If the initialization vector used by the transmitting communication device 20 is included (at least partially) in the protected data frame, this initialization vector can be extracted and used to process the protected content. Before processing the protected content, the receiving communication device 20 can perform further verification on the initialization vector extracted from the protected data frame. For example, when the used initialization vector is included at least partially in the received protected data frame, the receiving method 60 in some cases includes an optional step S68 of evaluating whether the used initialization vector has expired. If the lifetime of the extracted initialization vector has expired (reference sign S68a in FIG. 6), a potential security problem is detected, and the receiving method 60 optionally includes a step S66 of reporting the potential security problem to the application layer 50 and / or an administrator of the (industrial) LAN.If the lifetime of the initialization vector has not expired (reference sign S68b in FIG. 6), step S63 of processing the extracted protected content is executed.

[0065] If the processing of the protected content is successful (i.e., the transmitting communication device 20 is authenticated and / or the data is decrypted successfully), the receiving method 60 proceeds to step S64, where the data extracted from the protected data frame is forwarded to the application layer 50 of the application unit 21.

[0066] If the protected content is identical to the protected content of the previous time cycle (reference symbol S62b in FIG. 6), the results of processing the protected content of the protected data frame of the previous time cycle can be reused without processing the protected content of the protected data frame of the current time cycle, for example, data received during the previous time cycle can be forwarded to the application layer 50 as data received in the current time cycle.

[0067] On the other hand, in some cases, further verification can be performed; for example, the receiving method 60 of FIG. 6 includes an optional step S65 of evaluating whether the initialization vector used by the transmitting communication device 20 has expired. Indeed, the receiving communication device 20 can determine that the initialization vector should have been updated due to the expiration of its lifetime. Thus, if the initialization vector has expired, this means that the transmitting communication device 20 must have used an updated initialization vector, and the protected content should not be identical to the protected content of the previous time cycle, which would indicate a potential security problem, such as a replay attack. A similar evaluation can be performed when a symmetric key is used. Indeed, if an updated symmetric key was used by the transmitting communication device 20, the protected content should not be identical to the protected content of the previous time cycle, which would also indicate a potential security problem, such as a replay attack.

[0068] If the lifetime of the initialization vector has expired (reference sign S65a in FIG. 6), a potential security problem is detected and the receiving method 60 optionally includes step S66 of reporting the potential security problem to the application layer 50 and / or an administrator.

[0069] If the lifetime of the initialization vector has not expired (reference symbol S65b in FIG. 6), the result of the last processing of the same protected content (received in a previous time cycle) can be reused, and there is no need to process the protected content received in the current time cycle. The reception method includes a step S67 of reusing the result of processing the previous protected content in the previous time cycle. This step includes, for example, forwarding data received during the previous time cycle to the application layer 50 as data received in the current time cycle. Since there is no need to process the protected content every time cycle, the computational complexity of the protected content processing (and the security sublayer 51 in general) is limited and suitable for software implementation. Therefore, the step S63 of processing the protected content can be fully implemented in software, in which case the method can be introduced even in existing industrial networks by a simple software update of the communication device 20 without any hardware changes.

[0070] A non-limiting example of protected content computation in the non-limiting case where the IE-TSN protocol stack is used to transport data generated by the application layer 50 of the application unit 21 will now be described.

[0071] A PDU to be transmitted by the IE-TSN protocol stack contains a collection of 16-bit value registers (called Reg16 registers) and Boolean I / O states (called IO bits), all managed by the application layer 50. For example, the application layer may manage n IO bits called IO[1...n] and m Reg16 (16-bit) registers called Reg16[1...m].

[0072] For example, if the protected content supports a signature, the signature can be copied after it is requested. sigAn additional Reg16 register can be introduced, called the signature register (if the signature has not changed from the previous time cycle, there is no need to recalculate the signature, just the Reg16 sig (The register contents can remain unchanged from the previous time cycle.) The signature calculation can use any cryptographic algorithm known to those skilled in the art, e.g., cryptographic hash functions such as SHA, MD5, etc., hash functions.

[0073] If the protected content corresponds to encrypted data, this encrypted data can be copied in the IO bits and / or Reg16 register (thereby erasing the unencrypted data to be sent that was previously copied in the IO bits and Reg16 register by the application layer 50). However, some encryption algorithms, such as the Advanced Encryption Standard (AES), process words of a fixed size, for example, 256-bit words in the case of the AES-256 algorithm. Therefore, if the number of bits (data to be sent) in the IO bits and Reg16 register is less than, for example, 256 bits, the data to be sent can first be padded (for example, with bits set to 0) to obtain a 256-bit word, and the 256-bit encrypted (padded) data can be copied in the IO bits and Reg16 register. enc To be able to store it in a register, use Reg16 enc An additional Reg16 register called the IO register can be used. Of course, it is also possible to encrypt only part of the data and send the remaining data unencrypted. For example, the data in the Reg16 register can be encrypted, while the data in the IO bit can be sent unencrypted. The calculation of the encrypted data can use any encryption algorithm known to those skilled in the art, such as AES, Triple DES, RSA, etc.

[0074] Figure 7 shows a schematic representation of a non-limiting example of a signature calculation using a symmetric key. In the example shown in Figure 7, the dynamic part of the initialization vector is also sent along with the data and signature received from the application layer, and is stored in Reg16 IV In the example shown in Figure 7, the Reg16 IV [1...n IV ] called n IV Reg16 IV n registers are used so that the dynamic part of the initialization vector has 32 bits. IV = 2. The initialization vector also contains a static part, which is not transmitted, and in this example, Reg16 IV [1...n IV ] corresponds to the 16-bit IE-TSN address of the transmitting communication device 20 concatenated with the dynamic part of the initialization vector in IO[1...n] and Reg16[1...m]. To calculate the signature, the initialization vector (static and dynamic parts) is concatenated with the data received from the application layer in IO[1...n] and Reg16[1...m]. The resulting concatenated data is combined with a 256-bit symmetric key, for example, by using a cryptographic hash function to obtain a Keyed-Hash Message Authentication Code (HMAC) (defined by RFC2104). For example, the hash function used is the SHA function (defined by RFC6234). By doing so, a 256-bit HMAC is obtained. To reduce the size of the PDU transferred to the IE-TSN protocol stack, the HMAC may optionally be truncated to generate the signature. For example, only the most significant 32 bits (MSBs) of the HMAC are kept, thereby generating a 32-bit signature that can be used to authenticate the transmitting communication device 20. This signature is stored in Reg16 sig [1...n sig ] called n sig = 2 Reg16 sig It can be copied in a register.

[0075] Figure 8 schematically illustrates a non-limiting example of an IE-TSN protected data frame that includes the signature (protected data) of Figure 7. As noted above, this example contemplates, without limitation, that the dynamic portion of the initialization vector is also included in the PDU forwarded to the IE-TSN protocol stack implemented by communication unit 22. However, in other examples, the initialization vector may be included completely, only partially, or not at all in the PDU forwarded to the IE-TSN protocol stack.

[0076] As can be seen in Figure 8, the IE-TSN frame structure remains unchanged, the only change is that the size of the PDU transferred to the IE-TSN protocol stack is now specified in register Reg16 IV [1...n IV ] and Reg16 sig [1...n sig ]. Therefore, the IE-TSN protocol stack is not modified, since the security mechanisms are applied by the upper security sublayer 51, which is above the IE-TSN protocol stack and below the application layer 50. In case the periodic data frame generation performed by the communication unit 22 is hardware (FPGA, ASIC) accelerated, the introduction of the security mechanisms does not require any changes to the existing hardware accelerated periodic data frame generation.

[0077] Therefore, this disclosure proposes a solution for introducing a security mechanism with limited computational complexity into periodic transmissions in LANs, particularly industrial LANs. For example, by introducing the security mechanism in a higher protocol layer (security sublayer 51) immediately below the application layer 50, the lower protocol layers are not affected by the introduction of the security mechanism. In particular, the security mechanism can be smoothly introduced on top of any industrial Ethernet (TSN) protocol stack. Furthermore, the computational complexity is limited by limiting the frequency at which the protected content needs to be calculated (i.e., by actually executing the cryptographic algorithm), so that the security sublayer 51 can be implemented in software and can be deployed in existing industrial networks with a simple software update. The proposed security mechanism increases robustness against at least some of the potential attacks mentioned above. For example, data encryption increases robustness against eavesdropping. The inclusion of a signature increases robustness against data frame injection attacks and data frame replay attacks.

Claims

1. 1. A method of transmitting data by a communication device over a communication channel shared by the communication devices, wherein communication over the communication channel is organized according to a time cycle that repeats with a predetermined cycle period, the communication device is required to transmit data for each time cycle, and if there is no new data to transmit, the data to be transmitted is repeated from one time cycle to a subsequent time cycle, the method comprising the steps of: determining, by the communications device, a protected data frame based on the data to be transmitted; the communication device transmitting the protected data frame over the communication channel; Including, 10. A method for transmitting a data frame comprising: a protected data frame including protected content determined by using a predetermined initialization vector; the initialization vector having a lifetime associated with the initialization vector corresponding to a maximum duration for which the initialization vector can be maintained without being changed; the lifetime being equal to or greater than a predetermined multiple of a cycle period; and the initialization vector not being changed when data to be transmitted in a current time cycle is identical to data transmitted in a previous time cycle, provided that the lifetime of the initialization vector has not expired.

2. 2. The transmission method of claim 1, wherein the protected content of the protected data frames of the previous time cycle is repeated in the current time cycle without recalculating the protected content in response to determining that recalculating the protected content of the current time cycle would result in the same protected content as the previous time cycle.

3. The transmission method of claim 2 , wherein determining the protected content of the protected data frame is performed by software.

4. 4. The transmission method according to claim 1, wherein each of the time cycles includes at least a first time slice and a second time slice, the first time slice being for communicating data having higher timing constraints than data communicated during the second time slice, and the protected data frame being transmitted during the first time slice.

5. 4. The transmission method according to claim 1, wherein the protected data frame is determined by providing the protected content to an Industrial Ethernet protocol stack or an Industrial Ethernet Time Sensitive Networking (TSN) protocol stack.

6. The transmission method according to any one of claims 1 to 3, wherein the lifetime of the initialization vector is at least N times the cycle period, for N≧2.

7. Transmission method according to any one of claims 1 to 3, wherein the protected content of each protected data frame is further determined by using a predetermined symmetric key.

8. The transmission method according to any one of claims 1 to 3, wherein the protected content comprises signed and / or encrypted data.

9. The transmission method according to any one of claims 1 to 3, wherein the protected data frame includes all or part of the initialization vector.

10. A receiving method for receiving a data frame by a communication device, the data frame being transmitted by another communication device by using a transmission method according to any one of claims 1 to 3, the communication device processing the protected content contained in the protected data frame to authenticate the other communication device and / or decrypt the data contained in the protected data frame, the receiving method comprising: receiving a protected data frame in the current time cycle; extracting the protected content from the protected data frames of the current time cycle; in response to detecting that the protected content extracted from the protected data frame of the current time cycle is identical to the protected content extracted from the protected data frame received in the previous time cycle and detecting that the initialization vector has not expired, reusing a result of processing the protected content of the protected data frame of the previous time cycle without processing the protected content of the protected data frame of the current time cycle; a receiving method,

11. 11. The method of claim 10, wherein the processing of the protected content is performed by software.

12. A computer program comprising instructions which, when executed by at least one processor, configure said at least one processor to perform the transmission method of any one of claims 1 to 3.

13. 11. A computer program comprising instructions that, when executed by at least one processor, configure the at least one processor to perform the receiving method of claim 10.

14. A computer-readable storage medium comprising instructions that, when executed by at least one processor, configure the at least one processor to perform the transmission method of any one of claims 1 to 3.

15. 11. A computer-readable storage medium comprising instructions that, when executed by at least one processor, configure the at least one processor to perform the receiving method of claim 10.

16. A communication device comprising at least one processor and at least one memory, and configured to perform the transmission method according to any one of claims 1 to 3.

17. A communication device comprising at least one processor and at least one memory, the communication device being configured to perform the receiving method of claim 10.

18. 17. A local area network (LAN) comprising a plurality of communication devices according to claim 16, at least some of the communication devices being connected to one another according to a daisy chain topology.

19. 20. A local area network (LAN) comprising a plurality of communication devices according to claim 17, at least some of said communication devices being connected to one another according to a daisy chain topology.

Images