Secured Ethernet Frames for TSN-Compatible Industrial Communication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing industrial Ethernet communication protocols lack flexibility in securing data integrity and confidentiality, particularly in Time-Sensitive Networking environments, and are not compatible with low-cost systems and OPC-UA configurations.
Innovation Solution
Implementing secured Ethernet frames with flexible security overhead by adding a secure policy, initialization vector, and authentication tag, utilizing symmetric cryptographic keys and hardware crypto accelerators, which can be integrated into the Ethernet driver layer without specific hardware requirements.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing secure communication protocols (IPsec, MACsec, TLS, DTLS, OPC-UA Secure) are implemented in industrial Ethernet networks, then data security and integrity are improved, but device complexity and computational overhead increase significantly
Solution Approach 1:
The patent segments the security implementation by introducing a dedicated security header structure that separates authentication data (authentication ID, timestamp, sequence number) from the payload. This segmentation allows the security mechanism to operate independently at the Ethernet frame level without requiring complex protocol stack modifications, thereby reducing device complexity while maintaining data security.
Solution Approach 2:
The patent introduces an intermediary authentication mechanism that uses a shared secret key and hash function to generate authentication data. This intermediary layer sits between the application layer and physical layer, providing security services without requiring full implementation of complex protocols like TLS or IPsec, thus reducing computational overhead and device complexity.
2Reliability
If comprehensive security protocols are deployed in industrial Ethernet networks, then data confidentiality and integrity are improved, but communication time latency increases
Solution Approach 1:
The patent implements preliminary action by pre-sharing secret keys between communicating devices before actual data transmission. The authentication header includes pre-computed elements (authentication ID, timestamp, sequence number) that are prepared in advance. This allows fast authentication during transmission without real-time cryptographic computation, significantly reducing communication latency while maintaining data integrity.
Solution Approach 2:
The patent changes the parameter of authentication computation by using a lightweight hash function instead of heavy cryptographic algorithms. The authentication data is generated using a simple hash operation on the payload and header fields, which can be computed extremely quickly. This parameter change reduces computational time from milliseconds to microseconds, eliminating latency issues while preserving integrity verification.
3Reliability
If security overhead is increased to provide robust authentication and encryption, then data security is improved, but compatibility with Time-Sensitive Networking and low-cost systems deteriorates
Solution Approach 1:
The patent applies local quality by implementing security selectively only where needed - adding an authentication header only to frames requiring security verification. The security mechanism operates locally at the Ethernet frame level without affecting TSN timing parameters or requiring modifications to TSN switch configurations. This localized approach maintains TSN compatibility while providing strong authentication for security-critical communications.
Solution Approach 2:
The patent uses partial action by implementing only the essential authentication functionality rather than full encryption and authentication suites. The authentication header contains minimal necessary data (authentication ID, timestamp, sequence number, and hash value) without adding excessive overhead. This partial implementation provides sufficient authentication strength for industrial applications while maintaining compatibility with TSN and low-cost systems that cannot handle heavy cryptographic loads.
Data Source
AI summary
A method for transmitting secured Ethernet frames on a communication line, the method including the following in a transmitter module: receiving an Ethernet frame comprising payload data from a network layer; retrieving a secure policy, defining the type of security to be applied to the Ethernet frame; producing an initialization vector based on an encryption counter and a physical address of the transmitter module; creating an authentication tag by applying an authentication algorithm on the secure policy, the initialization vector and the payload data using a shared key and the initialization vector; adding the secure policy, the initialization vector and the authentication tag to the payload data to create a secured Ethernet frame; and sending the secured Ethernet frame to a data link layer for transmission on the communication line.