Modbus TCP Communication Security Solution
Modbus was invented by Modicon in 1979 and is the world's first bus protocol that is truly used in industrial sites. In China, Modbus has become the national standard GB/T19582-2008. Modbus protocol is a common language used in electronic controllers. Through this protocol, controllers can communicate with each other, controllers via a network (such as Ethernet), and other devices. It has become a common industry standard.
1. Overview SCADA, DCS, PCS, PLC and other industrial control systems are widely used in the fields of industry, energy, transportation, water conservancy, and municipal administration to control the operation of production equipment. Once loopholes in information security in industrial control systems occur, it will cause major hidden dangers to industrial production operations and national economic security. The Notice of the Ministry of Industry and Information Technology [2011] No. 451 explicitly pointed out that there are still many problems in the information security management of China's industrial control system. The main problems are insufficient attention to information security issues in industrial control systems, inadequate management systems, lack of relevant standards, and technical protection. Measures are not in place, security protection capability and emergency response capacity are not high, threatening the safety of industrial production and the normal operation of society. In this regard, all regions, departments, and units must attach great importance to enhance risk awareness, sense of responsibility and urgency, and effectively strengthen the information security management of industrial control systems.
Using the Modbus protocol, control devices from different manufacturers can be connected into an industrial network for centralized monitoring. This protocol defines a message structure that a controller can recognize, regardless of the network through which they communicate. It describes how a controller requests access to other devices, how to respond to requests from other devices, and how to detect and record errors. It has developed a common format for message domain patterns and content.
When communicating over a Modbus network, this protocol determines that each controller needs to know their device address, identify messages sent by address, and decide what action to take. If you need to respond, the controller will generate feedback and send it using the Modbus protocol. On other networks, messages containing the Modbus protocol are converted into frames or packet structures used on this network. This conversion also extends the method of addressing section addresses, routing paths, and error detection based on specific networks. Modbus has the following features:
â— Standard and open, users can use the Modbus protocol free and at ease. At present, there are more than 400 manufacturers that support Modbus and more than 600 products that support Modbus.
â— Modbus can support a variety of electrical interfaces, such as RS-232, RS-485, etc., can also be transmitted on various media, such as twisted-pair, fiber optic, wireless and so on.
â— Modbus frame format is simple, compact and easy to understand. Users are easy to use, and vendor development is simple.
2. Status and Analysis The simple system network structure is shown in the figure above. It is composed of three parts: information zone, station zone, and controller zone. Communication between the controller layer and the operator station layer follows the Modbus protocol. The current state of the art is that most computers that are running on the control network have little or no opportunity to install 24/7 virus protection or newer versions. Controllers are designed to optimize real-time I/O functionality, and do not provide enhanced network connection security. And many control networks are "open", and there is no effective isolation between different subsystems. When a problem occurs at the operation station level, the virus spreads quickly through the network, affecting the control layer equipment, and bringing the plant huge loss.
At present, petrochemicals, water treatment, and manufacturing industries have basically complied with the requirements of the industry standard ANSI/ISA-99 Standards in order to avoid major risks. ANSI/ISA-99 and North American Electric Reliability Council (NERC) CIP-005 all indicate that the process control system or SCADA control network should be isolated from other systems, including enterprise IT networks. The key points of control network security are as follows:
It should be noted that the security requirements of commercial networks and the security requirements of control networks are completely different in some places. In terms of communication applications in the industrial field, Gatekeepers and ordinary IT firewalls have certain limitations in their functions. They cannot implement security protection based on the requirements of industrial control networks, and are not conducive to late maintenance. Therefore, do not try to put the control system into the IT solution. Use a proprietary control system firewall and a good control system security strategy to provide an efficient network attack defense capability for industrial control system security. Tofino is a cost-effective way to meet this security requirement.
3. Tofino Solution This solution is mainly devoted to solving the security problem of the control layer equipment that communicates with the Modbus protocol in the field.
3.1 Solution Highlights Tofino can be used to separate the security system network from the process system network and achieve physical isolation of critical and non-critical systems. Compared with common commercial firewalls, Tofino is more suitable for industrial control system security protection, mainly reflected in:
(1) Industrial type:
â— With reference to the safety requirements of ANSI/ISA-99 Standards for design concepts, products are more targeted and efficient, and are specifically designed for the safety protection of industrial control systems.
â— Built-in more than 50 kinds of proprietary industrial communication protocols, different from the conventional firewall, Tofino firewall is not only on the port of protection, more importantly, based on application layer packet depth inspection, is a new generation of industrial communication protocol firewall, for Industrial Communication provides unique, industrial-grade professional isolation and protection solutions.
â— With the ability to modify the firewall configuration online, the configured firewall policy can be modified in real-time without affecting industrial real-time communications. Other firewalls need to be powered off and restarted.
â— Industrial design, rail-mounted, low-power fanless, with the second district explosion-proof certification.
(2) Unique patented secure connection technology:
â— First of all, the firewall itself is based on a proprietary non-IP patented secure connection technology that can block any fraudulent attack.
â— Can hide the IP addresses of all devices behind the firewall, so that intruders can not find the target, but no way to talk about launching any attacks.
â— Integrate firewalls and virtual routes to control the direction of data communication paths, objects, and data flows of communication networks like network traffic. You can set data inflow and outflow unidirectionally or bidirectionally.
(3) ANSI/ISA-99 and NERC-CIP standards are exclusively available in the market. According to the ANSI/ISA-99 and NERC-CIP standards, TSA can provide a very cost-effective solution for PLC, DCS, RTU, IED, and HMI. Secure Partition - A properly configured group of protection zones.
(4) Unique 'test' mode 'Test' mode allows firewall and VPN testing without any risk to the control system. The TEST mode is different from the actual operation mode. In the TEST mode, Tofino allows all communication to pass, but the CMP reports any communication that may be intercepted in the operation mode. This is critical for the safe operation of industrial or SCADA control systems and cannot be achieved with traditional IT firewalls. This is one aspect of Tofino's uniqueness to industrial control systems.
(5) Real-time network communication telescope:
It can provide a simple, effective and reliable tool for current network fault analysis, monitoring, and recording. It can accurately observe, analyze, and control the communication protocols, data speeds, and access objects used in network communication cables. Realizes real-time alarms, source confirmation, and historical records of illegal communications to ensure real-time diagnosis of control network communications.
3.2 Solution Composition A complete Tofino security solution consists of the following four parts:
(1) Tofino Security Module (TSA)
The enhanced industrial environment requires design, plug-and-play, and is applied before critical equipment such as protected areas or controllers. The following figure shows two types of Tofino security module hardware. The hardware design follows the requirements of enhanced industrial environments. Before being applied to key equipment such as protected areas or controllers, the design has a service life of 27 years and can provide an industrial platform for safety systems.
(2) Tofino Loadable Security Software Plug-in (LSM)
The security software plug-in designed for industrial communication protocols can be directly loaded into the Tofino security module and various customized security services can be provided according to the system requirements. The optional basic soft plugins in the scenario include:
â—TofinoFirewall LSM industrial communication firewall;
Industrial Network Traffic*, a soft plug-in that provides firewall and network traffic control features Built-in more than 50 industrial-specific and commercial IT communication protocols, pre-defined more than 25 controller types (eg Siemens S7-300/S7-400, Honeywell PKSC200/C300 /); LSM online protocol configuration, you can customize the communication protocol or through the device learning function to achieve communication protocol customization; through the communication protocol instruction level control, pre-configured for advanced filtering and attack protection "special rules." Meet the network segmentation requirements of ANSI/ISA-99.00.02 to achieve regional isolation goals.
â— ModbusTCPEnforcerLSM communication depth detection and protection;
The first product to be able to in-depth inspection of internal industrial protocols, the control engineer can define the list of allowed Modbus instructions, registers and coil lists. Automatically block and report that any traffic does not match your rules. All agreements must be fully and comprehensively examined to inspect and prevent any communication content that does not comply with the Modbus communication protocol.
â—SecureAssetManagementLSM security equipment asset management;
Like radar, Tofino's Secure Asset Management (SAM) loadable module can track every device that communicates via the Tofino security device. However, in order to avoid causing process interference, it does not use traditional scanning techniques to achieve this function.
â— EventLogger LSM event log and alarm management;
The Tofino Event Recorder Loadable Module provides reliable monitoring and recording of your security events. It is a logging system designed specifically for industrial control networks.
(3) Tofino Central Management Platform (CMP)
The windowed central management platform system and database are used for the configuration, configuration and management of the Tofino security module, and can realize real-time monitoring and historical query of the system's alarm and log. It can provide a simple, effective and reliable tool for current network fault analysis, monitoring, and recording. It can accurately observe, analyze, and control the communication protocols, data speeds, and access objects used in network communication cables. Realizes real-time alarms, source confirmation, and historical records of illegal communications to ensure real-time diagnosis of control network communications. With online configuration, online monitoring, asset management and other functions.
(4) Tofino Security Management Platform (SMP)
The SMPServer receives the log and alarm records of the CMP or TSA and stores the logs and alarms in the server database. The SMPClient is installed in an office computer on an office LAN, supports real-time display of logs and alarm records collected by the CMP or TSA in a graphical manner, and supports query of logs and alarms.
3.3 Introduction and implementation of the product The selection of the product and the implementation of the project can be summarized in the following three steps. In practice, different environmental and safety requirements are required, and specific plans and implementation processes are slightly different.
Step 1: Create a Network Security Partition?, determine where to place the TOFINO Security Appliance TSA.
Step 2: Determine which loadable security function soft plug-ins (LSMs) are needed to ensure different security requirements for each area.
Step 3: Select a server or workstation to install TOFINO Central Management Platform CMP and Tofino Security Management Platform SMP, CMP and SMP can also be installed on different machines.
In combination with the network structure of the above control system, the present scheme describes in detail the protection that the Modbus communication control device needs to perform.
(1) Based on the purpose of protecting the control layer equipment, in this solution, the control layer equipment is used as a security zone. A TSA is deployed between the control layer and the operating station layer. After the control layer equipment is placed behind the TSA, it is performed with the operating station layer. isolation.
(2) Considering the use of the Modbus protocol for communication between the control layer and the operator station layer, the proposed LSM software plug-in is as follows:
(3) Choose the right machine in the network to install CMP and SMP. You can also use a separate computer to install CMP and SMP, create the entire network model, and set the appropriate communication rules to ensure that only legitimate communications in the network are passed. All the equipment and hardware of the plant are managed centrally and the status of the whole plant control network is clear at a glance.
3.4 Solution Objectives The plan is based on the establishment of a defense-in-depth strategy to ensure that even if a network security incident occurs in a factory network, the factory can operate normally. At the same time, the plant operators can quickly find the problems and handle them, mainly to the following: aims:
â— Area isolation: The Tofino Industrial Firewall plug-in filters traffic between two regional networks. This means that network failures will be controlled in the area where it originally occurred without affecting other parts;
â— Depth check: For the application layer, in-depth inspection of specific industrial communication protocols and bid farewell to the defect of virus database upgrade;
â— Communication control: Communication rules can be configured and tested online through the central management platform.
â— Real-time alarm: All deployed firewalls can be uniformly monitored by the central management platform in real time. Any illegal (unconfigured) access will generate real-time alarm information in the central management platform, so that faults will occur in the original area. Was quickly found and resolved.
IV. Conclusion Tofino industrial network security solutions are specifically designed for control system networks and are designed to provide a partitioned security solution. Tofino has a very high price/performance ratio. It can build a deep protection architecture in the factory floor. Therefore, even if there are hackers or viruses passing through the main corporate firewall, they will face professional security equipment designed based on the characteristics of the control network. For industrial enterprises, Tofino Security System means the best safety benefits and technical support, and it does not simply satisfy the safety requirements of independent critical control equipment.
Unlike traditional IT firewalls, Tofino is designed to control network communication security in industrial environments. Field technicians simply plug in Tofino's power supply and connect two network cables without any other operations. Once installed, technicians can effortlessly manage any system to react to cyber threats in a timely manner by taking the overall situation of the company as a whole. Most importantly, Tofino can be used flexibly in small plants that are simply PLCs, and it can meet the requirements of those large multinational groups that have tens of thousands of devices and distribute around the world.
1. Overview SCADA, DCS, PCS, PLC and other industrial control systems are widely used in the fields of industry, energy, transportation, water conservancy, and municipal administration to control the operation of production equipment. Once loopholes in information security in industrial control systems occur, it will cause major hidden dangers to industrial production operations and national economic security. The Notice of the Ministry of Industry and Information Technology [2011] No. 451 explicitly pointed out that there are still many problems in the information security management of China's industrial control system. The main problems are insufficient attention to information security issues in industrial control systems, inadequate management systems, lack of relevant standards, and technical protection. Measures are not in place, security protection capability and emergency response capacity are not high, threatening the safety of industrial production and the normal operation of society. In this regard, all regions, departments, and units must attach great importance to enhance risk awareness, sense of responsibility and urgency, and effectively strengthen the information security management of industrial control systems.
Using the Modbus protocol, control devices from different manufacturers can be connected into an industrial network for centralized monitoring. This protocol defines a message structure that a controller can recognize, regardless of the network through which they communicate. It describes how a controller requests access to other devices, how to respond to requests from other devices, and how to detect and record errors. It has developed a common format for message domain patterns and content.
When communicating over a Modbus network, this protocol determines that each controller needs to know their device address, identify messages sent by address, and decide what action to take. If you need to respond, the controller will generate feedback and send it using the Modbus protocol. On other networks, messages containing the Modbus protocol are converted into frames or packet structures used on this network. This conversion also extends the method of addressing section addresses, routing paths, and error detection based on specific networks. Modbus has the following features:
â— Standard and open, users can use the Modbus protocol free and at ease. At present, there are more than 400 manufacturers that support Modbus and more than 600 products that support Modbus.
â— Modbus can support a variety of electrical interfaces, such as RS-232, RS-485, etc., can also be transmitted on various media, such as twisted-pair, fiber optic, wireless and so on.
â— Modbus frame format is simple, compact and easy to understand. Users are easy to use, and vendor development is simple.
2. Status and Analysis The simple system network structure is shown in the figure above. It is composed of three parts: information zone, station zone, and controller zone. Communication between the controller layer and the operator station layer follows the Modbus protocol. The current state of the art is that most computers that are running on the control network have little or no opportunity to install 24/7 virus protection or newer versions. Controllers are designed to optimize real-time I/O functionality, and do not provide enhanced network connection security. And many control networks are "open", and there is no effective isolation between different subsystems. When a problem occurs at the operation station level, the virus spreads quickly through the network, affecting the control layer equipment, and bringing the plant huge loss.
At present, petrochemicals, water treatment, and manufacturing industries have basically complied with the requirements of the industry standard ANSI/ISA-99 Standards in order to avoid major risks. ANSI/ISA-99 and North American Electric Reliability Council (NERC) CIP-005 all indicate that the process control system or SCADA control network should be isolated from other systems, including enterprise IT networks. The key points of control network security are as follows:
It should be noted that the security requirements of commercial networks and the security requirements of control networks are completely different in some places. In terms of communication applications in the industrial field, Gatekeepers and ordinary IT firewalls have certain limitations in their functions. They cannot implement security protection based on the requirements of industrial control networks, and are not conducive to late maintenance. Therefore, do not try to put the control system into the IT solution. Use a proprietary control system firewall and a good control system security strategy to provide an efficient network attack defense capability for industrial control system security. Tofino is a cost-effective way to meet this security requirement.
3. Tofino Solution This solution is mainly devoted to solving the security problem of the control layer equipment that communicates with the Modbus protocol in the field.
3.1 Solution Highlights Tofino can be used to separate the security system network from the process system network and achieve physical isolation of critical and non-critical systems. Compared with common commercial firewalls, Tofino is more suitable for industrial control system security protection, mainly reflected in:
(1) Industrial type:
â— With reference to the safety requirements of ANSI/ISA-99 Standards for design concepts, products are more targeted and efficient, and are specifically designed for the safety protection of industrial control systems.
â— Built-in more than 50 kinds of proprietary industrial communication protocols, different from the conventional firewall, Tofino firewall is not only on the port of protection, more importantly, based on application layer packet depth inspection, is a new generation of industrial communication protocol firewall, for Industrial Communication provides unique, industrial-grade professional isolation and protection solutions.
â— With the ability to modify the firewall configuration online, the configured firewall policy can be modified in real-time without affecting industrial real-time communications. Other firewalls need to be powered off and restarted.
â— Industrial design, rail-mounted, low-power fanless, with the second district explosion-proof certification.
(2) Unique patented secure connection technology:
â— First of all, the firewall itself is based on a proprietary non-IP patented secure connection technology that can block any fraudulent attack.
â— Can hide the IP addresses of all devices behind the firewall, so that intruders can not find the target, but no way to talk about launching any attacks.
â— Integrate firewalls and virtual routes to control the direction of data communication paths, objects, and data flows of communication networks like network traffic. You can set data inflow and outflow unidirectionally or bidirectionally.
(3) ANSI/ISA-99 and NERC-CIP standards are exclusively available in the market. According to the ANSI/ISA-99 and NERC-CIP standards, TSA can provide a very cost-effective solution for PLC, DCS, RTU, IED, and HMI. Secure Partition - A properly configured group of protection zones.
(4) Unique 'test' mode 'Test' mode allows firewall and VPN testing without any risk to the control system. The TEST mode is different from the actual operation mode. In the TEST mode, Tofino allows all communication to pass, but the CMP reports any communication that may be intercepted in the operation mode. This is critical for the safe operation of industrial or SCADA control systems and cannot be achieved with traditional IT firewalls. This is one aspect of Tofino's uniqueness to industrial control systems.
(5) Real-time network communication telescope:
It can provide a simple, effective and reliable tool for current network fault analysis, monitoring, and recording. It can accurately observe, analyze, and control the communication protocols, data speeds, and access objects used in network communication cables. Realizes real-time alarms, source confirmation, and historical records of illegal communications to ensure real-time diagnosis of control network communications.
3.2 Solution Composition A complete Tofino security solution consists of the following four parts:
(1) Tofino Security Module (TSA)
The enhanced industrial environment requires design, plug-and-play, and is applied before critical equipment such as protected areas or controllers. The following figure shows two types of Tofino security module hardware. The hardware design follows the requirements of enhanced industrial environments. Before being applied to key equipment such as protected areas or controllers, the design has a service life of 27 years and can provide an industrial platform for safety systems.
(2) Tofino Loadable Security Software Plug-in (LSM)
The security software plug-in designed for industrial communication protocols can be directly loaded into the Tofino security module and various customized security services can be provided according to the system requirements. The optional basic soft plugins in the scenario include:
â—TofinoFirewall LSM industrial communication firewall;
Industrial Network Traffic*, a soft plug-in that provides firewall and network traffic control features Built-in more than 50 industrial-specific and commercial IT communication protocols, pre-defined more than 25 controller types (eg Siemens S7-300/S7-400, Honeywell PKSC200/C300 /); LSM online protocol configuration, you can customize the communication protocol or through the device learning function to achieve communication protocol customization; through the communication protocol instruction level control, pre-configured for advanced filtering and attack protection "special rules." Meet the network segmentation requirements of ANSI/ISA-99.00.02 to achieve regional isolation goals.
â— ModbusTCPEnforcerLSM communication depth detection and protection;
The first product to be able to in-depth inspection of internal industrial protocols, the control engineer can define the list of allowed Modbus instructions, registers and coil lists. Automatically block and report that any traffic does not match your rules. All agreements must be fully and comprehensively examined to inspect and prevent any communication content that does not comply with the Modbus communication protocol.
â—SecureAssetManagementLSM security equipment asset management;
Like radar, Tofino's Secure Asset Management (SAM) loadable module can track every device that communicates via the Tofino security device. However, in order to avoid causing process interference, it does not use traditional scanning techniques to achieve this function.
â— EventLogger LSM event log and alarm management;
The Tofino Event Recorder Loadable Module provides reliable monitoring and recording of your security events. It is a logging system designed specifically for industrial control networks.
(3) Tofino Central Management Platform (CMP)
The windowed central management platform system and database are used for the configuration, configuration and management of the Tofino security module, and can realize real-time monitoring and historical query of the system's alarm and log. It can provide a simple, effective and reliable tool for current network fault analysis, monitoring, and recording. It can accurately observe, analyze, and control the communication protocols, data speeds, and access objects used in network communication cables. Realizes real-time alarms, source confirmation, and historical records of illegal communications to ensure real-time diagnosis of control network communications. With online configuration, online monitoring, asset management and other functions.
(4) Tofino Security Management Platform (SMP)
The SMPServer receives the log and alarm records of the CMP or TSA and stores the logs and alarms in the server database. The SMPClient is installed in an office computer on an office LAN, supports real-time display of logs and alarm records collected by the CMP or TSA in a graphical manner, and supports query of logs and alarms.
3.3 Introduction and implementation of the product The selection of the product and the implementation of the project can be summarized in the following three steps. In practice, different environmental and safety requirements are required, and specific plans and implementation processes are slightly different.
Step 1: Create a Network Security Partition?, determine where to place the TOFINO Security Appliance TSA.
Step 2: Determine which loadable security function soft plug-ins (LSMs) are needed to ensure different security requirements for each area.
Step 3: Select a server or workstation to install TOFINO Central Management Platform CMP and Tofino Security Management Platform SMP, CMP and SMP can also be installed on different machines.
In combination with the network structure of the above control system, the present scheme describes in detail the protection that the Modbus communication control device needs to perform.
(1) Based on the purpose of protecting the control layer equipment, in this solution, the control layer equipment is used as a security zone. A TSA is deployed between the control layer and the operating station layer. After the control layer equipment is placed behind the TSA, it is performed with the operating station layer. isolation.
(2) Considering the use of the Modbus protocol for communication between the control layer and the operator station layer, the proposed LSM software plug-in is as follows:
(3) Choose the right machine in the network to install CMP and SMP. You can also use a separate computer to install CMP and SMP, create the entire network model, and set the appropriate communication rules to ensure that only legitimate communications in the network are passed. All the equipment and hardware of the plant are managed centrally and the status of the whole plant control network is clear at a glance.
3.4 Solution Objectives The plan is based on the establishment of a defense-in-depth strategy to ensure that even if a network security incident occurs in a factory network, the factory can operate normally. At the same time, the plant operators can quickly find the problems and handle them, mainly to the following: aims:
â— Area isolation: The Tofino Industrial Firewall plug-in filters traffic between two regional networks. This means that network failures will be controlled in the area where it originally occurred without affecting other parts;
â— Depth check: For the application layer, in-depth inspection of specific industrial communication protocols and bid farewell to the defect of virus database upgrade;
â— Communication control: Communication rules can be configured and tested online through the central management platform.
â— Real-time alarm: All deployed firewalls can be uniformly monitored by the central management platform in real time. Any illegal (unconfigured) access will generate real-time alarm information in the central management platform, so that faults will occur in the original area. Was quickly found and resolved.
IV. Conclusion Tofino industrial network security solutions are specifically designed for control system networks and are designed to provide a partitioned security solution. Tofino has a very high price/performance ratio. It can build a deep protection architecture in the factory floor. Therefore, even if there are hackers or viruses passing through the main corporate firewall, they will face professional security equipment designed based on the characteristics of the control network. For industrial enterprises, Tofino Security System means the best safety benefits and technical support, and it does not simply satisfy the safety requirements of independent critical control equipment.
Unlike traditional IT firewalls, Tofino is designed to control network communication security in industrial environments. Field technicians simply plug in Tofino's power supply and connect two network cables without any other operations. Once installed, technicians can effortlessly manage any system to react to cyber threats in a timely manner by taking the overall situation of the company as a whole. Most importantly, Tofino can be used flexibly in small plants that are simply PLCs, and it can meet the requirements of those large multinational groups that have tens of thousands of devices and distribute around the world.
Electric Tricycle With Sidecar
Electric Assist Bike,3 Wheel Electric Bike,Fat Tire Electric Tricycle,Electric Powered Tricycle
Wuxi Jiangyin Xufeng Electric Bicycle Co., Ltd. , https://www.relxrides.com