Robust Multicast Origin Authentication in MACsec for Secure IIoT Networked Embedded Systems
TL;DR
Some multicast OA strategies are presented and analyzed that improve robustness to frame losses by means of a dual keychain and enables transmitters to select strategies at runtime to achieve the best compromise among security, reliability, and resource consumption.
Abstract
Having everything interconnected through the Internet is making security a primary concern in the automotive and industrial domains as well. Vehicles and machinery often consist of embedded devices (smart sensors/actuators, electronics control units, and human–machine interfaces) locally interconnected through low-cost multidrop buses like single-pair Ethernet and controller area network (CAN XL). Although these protocols provide link-level security based on symmetric cryptography, they do not support origin authentication (OA) for multicast frames. Asymmetric cryptography is unsuitable for networked embedded control systems with real-time constraints and limited computational resources. In these cases, solutions derived from the timed efficient stream loss-tolerant authentication (TESLA) broadcast authentication protocol may constitute a more suitable option. In this article, some multicast OA strategies are presented and analyzed that improve robustness to frame losses by means of a dual keychain. A flexible authentication mechanism that relies on a unified receiver is then proposed, which enables transmitters to select strategies at runtime to achieve the best compromise among security, reliability, and resource consumption.