Jump to Articles from:   Issue 45       Issue 44       Issue 43       Issue 42       Issue 41       Issue 40       Issue 39       Issue 38       Issue 37       Issue 36       Issue 35       Issue 34       Issue 33       Issue 32       Issue 31       Issue 30       Issue 29       Issue 28       Issue 27       Issue 26       Issue 25       Issue 24       Issue 23       Issue 22       Issue 21       Issue 20       Issue 19       Issue 18       Issue 17       Issue 16       Issue 15       Issue 14       Issue 13       Issue 12       Issue 11       Issue 10       Issue 9       Issue 8       Issue 7       Issue 6       Issue 5       Issue 4       Issue 3       Issue 2       Issue 1

From Darrin Miller, security researcher with a major Infrastructure systems company. He specialises in SCADA, embedded device and process control architecture and security analysis

IEB: Our own view is that IA/Process Control has little direct interest in IPv6 at present and no impending applications absolutely dependent upon it. However, we suspect that the wider world will make real use of extended addressing and that the philosophy of an absolute address could filter sideways in our direction - and might yet have a bearing on industrial network architecture in the medium-long term. Is this your view?

DM: I would agree with this assessment for a variety of reasons, most significantly that the adoption rate in process control of new platforms/ applications that can support IPv6 is a medium-long term issue. No vendor I am dealing with has expressed anything other than a prototype development environment in terms of platforms, much less the applications.

IEB: The starting point for this hypothesis is the introduction of IPv6 and the possibility of address space by the trillion. Of course on its own, this means nothing to the world of automation and control since NAT provides for just about all foreseeable requirements for address expansion. True?

DM: In the current computing paradigm of client to server, yes. This is true. However, most IPv6 proponents quote three factors: mobility, ad hoc networks and peer to peer applications that are enough to invalidate NAT as a feasible option. I'll leave it up to you to make your determination, but I believe the mobility and ad hoc aspects will also be valid in process control networks.

IEB: The fact is that some standards groups - particularly PNO - are now talking in terms of network addressable field devices such as valves, sensors, pneumatics, indeed anything which could possibly 'benefit' from a degree of web services feedback monitoring as well as feed forward action commands over the network. How will this affect the future shape of industrial automation/process control?

DM: I think this will affect the operator's ability to manage the process network both in terms of the network devices themselves as well as the information overload that may occur.

IEB: Could one argue that a proliferation of IP-enabled devices will turn the traditional server/client relationship on its head? The standard network has few servers and many clients. Field device servers are many and the control stations - clients - are few. Could network management get out of control with simply too many servers to handle sensibly?

DM: Absolutely. This is a risk and why IPv6 is viewed as evolutionary as opposed to revolutionary in an effort to caution operators about the possible side effects of the explosion of devices. In addition this all adds new avenues of attack. These avenues are neither better or worse than IPv4, they are just new considerations.

IEB: Could the management of a massively increased data flow from the plant floor create a problem in its own right. The mantra of 'effective measurement leads to effective management' could get washed away by an inundation of data from newly talkative field devices... How on earth do you sort all this data into a clear management picture?

DM: To start the data flows will be very similar to what is already in existence. Over time new applications will develop that leverage the mobility and open aspect of the IPv6 network will drive new application adoption that will change this data flow and management model, but I think that is a longer term proposition. This is very analogous to the use of IP for voice. The collection of networks widely called the Internet existed for over 15 years before the idea of putting voice on that network gained mindshare. In those 15 years lots of thought was put into managing this new flow of data and has continued to evolve as VoIP has grown in popularity.

My personal opinion is that new applications using the mobile, ad hoc and open nature of the current IPv4 and IPv6 networks are going to be the drivers, not IPv6 unto itself. IPv6 does has benefits over IPv4, but the application that ONLY works on IPv6 needs to be developed before we see IPv6 take hold. Outside of process networks I see one of those applications being the mobility requirements for 4G (my term for the use of native voice encapsulation on a handset) that will drive the requirement for IPv6.

IEB: Will industrial network providers see the in-built security layers of IPv6 as a source of encouragement to adopt the protocol?

DM: In general I am suspect of equipment vendors adopting IPv6 for any security reasons, since they are having a hard enough time implementing robust IPv4 stacks on their embedded devices. Eric Byres is making a nice living on showing how vulnerable these devices are on being moved to Ethernet. Many operator tools (like network scans) have been demonstrated to cause security and reliability issues with these embedded devices. For this reason and also the very heavy computational load that IPv6 security mechanisms (public/private key cryptography, etc.) puts on a embedded system, I don't see IPv6 as a more secure transport being enough motivation to make the vendors move. They might move to IPv6 without security (similar to their move to IPv4 without security) if a new application paradigm is introduced that requires IPv6.