Cyclic LAN Frame Security With Reused Initialization Vectors
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Industrial networks with time-sensitive data transmission are vulnerable to security threats due to the integration of non-isolated devices, necessitating robust security mechanisms without compromising latency requirements.
Innovation Solution
A method for securing data transmission in industrial networks using initialization vectors with a limited computational complexity, allowing for software updates in existing devices, by ensuring secured content is determined only when data changes or a lifetime expires, and implemented in a higher protocol layer.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security mechanisms are introduced in industrial networks to protect against attacks, then network robustness is improved, but computational complexity and latency increase
Solution Approach 1:
The patent applies preliminary action by pre-computing and caching security parameters (MAC values, encryption keys) before data transmission occurs. The security subsystem generates and stores authentication data in advance, so that during actual transmission, only simple verification operations are needed, avoiding complex real-time computations that would increase latency.
Solution Approach 2:
The patent segments the security mechanism into separate functional components: a security subsystem that handles complex cryptographic operations independently from the main control subsystem. This segmentation allows the main system to focus on time-critical data transmission while the security subsystem processes authentication and encryption in parallel, reducing overall computational burden on the time-sensitive path.
2Reliability
If security mechanisms are implemented in existing communicating devices, then network security is improved, but hardware changes are required which increases device complexity
Solution Approach 1:
The patent replaces hardware-based security mechanisms with software-based implementations. The security subsystem is implemented as executable code that runs on the existing processor of communicating devices, eliminating the need for specialized hardware security modules or physical modifications to the device architecture. This allows security to be deployed through software updates alone.
Solution Approach 2:
The patent creates a universal security subsystem that can be integrated into existing communicating devices without requiring device-specific hardware modifications. The same security software can be deployed across different device types and manufacturers, providing consistent security functionality throughout the network while maintaining compatibility with existing hardware platforms.
3Object-affected harmful factors
If data frames are secured using cryptographic methods, then protection against eavesdropping and injection attacks is improved, but transmission latency increases
Solution Approach 1:
The patent implements periodic action by using time-aware scheduling that aligns security operations with the periodic nature of industrial data transmission. Security parameters are updated and verified at predetermined time intervals that match the cyclic data transmission pattern, allowing the system to prepare security measures in advance during idle periods and execute them synchronously with data frames, minimizing impact on transmission timing.
Solution Approach 2:
The patent applies preliminary action by pre-computing cryptographic parameters such as message authentication codes (MAC) and encryption keys before the actual data transmission occurs. The security subsystem prepares all necessary security data in advance during the inter-frame period, so that when the data frame needs to be transmitted, the security operations are already complete or can be executed in parallel, avoiding addition of transmission latency.
Data Source
AI summary
The present disclosure relates to a method for transmitting data by a communicating device on a communication channel, wherein the transmitting method comprises, for each temporal cycle:determining, by the communicating device, a secured data frame based on the data to be transmitted,transmitting, by the communicating device, the secured data frame on the communication channel,wherein each secured data frame includes secured content determined by using an initialization vector, wherein the initialization vector has a lifetime associated thereto, the lifetime being greater than or equal to a plurality of cycle periods, wherein the initialization vector is not modified when the data to be transmitted is identical to the data transmitted in the previous temporal cycle provided the lifetime of the initialization vector has not expired.