Department of Computer Engineering, Ajou University, 206, World cup-ro, Yeongtong-gu, Suwon-si, Gyeonggi-do 16499, Korea.
Department of Cybersecurity, Ajou University, 206, World cup-ro, Yeongtong-gu, Suwon-si, Gyeonggi-do 16499, Korea.
Sensors (Basel). 2018 Dec 10;18(12):4372. doi: 10.3390/s18124372.
Through the active development of industrial internet of things (IIoT) technology, there has been a rapid increase in the number of different industrial wireless sensor networks (IWSNs). Accordingly, the security of IWSNs is also of importance, as many security problems related to IWSN protocols have been raised and various studies have been conducted to solve these problems. However, the provisioning process is the first step in introducing a new device into the IIoT network and a starting point for IIoT security. Therefore, leakage of security information in the provisioning process makes exposure of secret keys and all subsequent security measures meaningless. In addition, using the exploited secret keys, the attacker can send false command to the node or send false data to the network manager and it can cause serious damage to industrial infrastructure depending on the IWSN. Nevertheless, a security study on the provisioning process has not been actively carried out, resulting in a provisioning process without guaranteed security. Therefore, in this paper, we analyzed security issues of the provisioning process in IWSN by researching prominent IWSN standards, including ISA 100.11a, WirelessHART, and Zigbee, and also an ISA 100.11a-certified device and provisioning process-related studies. Then, we verified the security issues of the provisioning process through testing and analyzing the provisioning process using the ISA 100.11a standard-implemented devices and ISA 100.11a-certified devices. Finally, we discuss security considerations and the direction of future research on provisioning security for IWSN in the IIoT era.
通过积极开发工业物联网 (IIoT) 技术，不同的工业无线传感器网络 (IWSN) 的数量迅速增加。因此，IWSN 的安全性也很重要，因为已经提出了许多与 IWSN 协议相关的安全问题，并且已经进行了各种研究来解决这些问题。然而，供应过程是将新设备引入 IIoT 网络的第一步，也是 IIoT 安全的起点。因此，供应过程中的安全信息泄漏会导致密钥泄露，所有后续的安全措施都变得毫无意义。此外，攻击者可以利用利用的密钥向节点发送虚假命令，或向网络管理员发送虚假数据，这可能会根据 IWSN 对工业基础设施造成严重破坏。然而，对供应过程的安全研究并没有得到积极开展，导致供应过程没有得到保证的安全性。因此，在本文中，我们通过研究包括 ISA 100.11a、WirelessHART 和 Zigbee 在内的知名 IWSN 标准，以及 ISA 100.11a 认证设备和与供应过程相关的研究，分析了 IWSN 供应过程中的安全问题。然后，我们通过使用实施了 ISA 100.11a 标准的设备和 ISA 100.11a 认证设备测试和分析供应过程，验证了供应过程中的安全问题。最后，我们讨论了在 IIoT 时代 IWSN 供应安全的安全考虑和未来研究方向。
