An Enrolment Gateway for Data Security in Heterogeneous Industrial Internet of Things

Abstract

Industry includes more and more IoT components to have a better control on production and logistic processes.Unfortunately, growing network openness in a formerly isolated world induces major security risks which are especially critical in an industrial context. These risks are exacerbated by the highly fragmented nature of the industrial IoT market which imposes interoperability management and challenges security.We propose an approach to enable end-to-end data security within a heterogeneous IoT deployment. Interoperability is ensured by a central network powered by oneM2M interacting with various tier protocols. In this paper, we focus on secure communication with ZigBee and discuss how it can be transposed to other protocols, namely Z-Wave and Thread.

Secure and Efficient Tunneling of MACsec for Modern Industrial Use Cases

“…Yet, even newer approaches lack security considerations (like [9]) and hence cannot be applied to our use case, where we assume zero trust networks. Other works consider security but employ new technologies and disregard the need for backwards compatibility for legacy components [14].…”

Secure key distribution in heterogeneous interoperable industrial Internet of Things

“…An existing specification, oneM2M, seems adequate to operate the central network and guarantee protocol interoperability. In [11], we proposed a high-level view of an approach to enable communication between a oneM2M node and a Zigbee device with end-to-end ciphering of the data exchanged. We chose to work on Zigbee because of its openness specification, the ease to find test devices -like XBee -, and the fact that Zigbee inspired other WPAN protocols.…”

“…In addition to the MEF, our complete solution requires the separation of the IPE in two entities: the IPE-OCI and the IPE-NI [11]. The former is involved in the communication and the deport of the translation capabilities within the oneM2M node.…”

“…Obviously, after this step, one should still ensure that communication is possible between the two nodes. In [11], we show how data translation could be deported in the oneM2M node after key provisioning, making communication with end-to-end encryption possible.…”