Device-Level Security for Legacy Equipment

July 21, 2021
Rockwell Automation’s new CIP security proxy device allows older systems and equipment to use digital certificates and encrypted communication for enhanced cybersecurity at the device level.

With high-profile cyberattacks growing in frequency, industry has become all too aware of the potential dark side of internet-connected devices. While plant-floor networks were once air-gapped to separate them from enterprise networks, this approach has become untenable, as the core functionality of Industry 4.0 and Internet of Things (IoT) initiatives are built on integration between operational technology (OT) and information technology (IT).

As a result, defense-in-depth strategies have grown in popularity. These approaches seek to use intentional redundancies at every layer of a system down to the device level to ensure security.

Watch this video on the  recent uptick in cybersecurity breaches.

To help operators achieve this, Rockwell Automation has released the Allen-Bradley Common Industrial Protocol (CIP) Security Proxy, which aims to allow end-users to more easily retrofit their systems to be compatible with CIP security methodologies.

CIP security works by initiating a transport layer security (TLS) “handshake” whenever a new device is added to a network. Before any communication is established, the TLS handshake checks to guarantee that the device being added possesses a security certificate that must be embedded in the device by the vendor. Once the identity of the device is established, encryption keys are created and exchanged, which allow the devices to communicate cryptographically, effectively baking security into the communications themselves. This ensures that communications are authentic, that they have not been altered by an outside party, and that they remain private.

Similar techniques have been used to ensure safe and confidential network communication in the IT world for many years, but it is the increased need for device-level security in industrial environments that has brought it to the plant floor.

However, some legacy systems and equipment may not have native support for CIP security, due to lacking hardware and firmware. To remedy this, Rockwell’s CIP Security Proxy can be connected to any EtherNet/IP-compliant device, granting it a security certificate and allowing it to engage in encrypted communication with higher-level systems.

The proxy device contains three gigabit EtherNet/IP ports, and can be configured through Rockwell’s FactoryTalk Policy Manager software and FactoryTalk system services. In addition, it supports motion for Kinetix drives and offers a web server for viewing diagnostics.

Companies in this Article

Sponsored Recommendations

Wireless Data Acquisition System Case Studies

Wireless data acquisition systems are vital elements of connected factories, collecting data that allows operators to remotely access and visualize equipment and process information...

Strategizing for sustainable success in material handling and packaging

Download our visual factory brochure to explore how, together, we can fully optimize your industrial operations for ongoing success in material handling and packaging. As your...

A closer look at modern design considerations for food and beverage

With new and changing safety and hygiene regulations at top of mind, its easy to understand how other crucial aspects of machine design can get pushed aside. Our whitepaper explores...

Fueling the Future of Commercial EV Charging Infrastructure

Miguel Gudino, an Associate Application Engineer at RS, addresses various EV charging challenges and opportunities, ranging from charging station design strategies to the advanced...