When SCADA and automation systems meet pairings: a novel cryptographic security enhancement for OPC UA

In the IIoT context, critical infrastructures are vulnerable to various cyber-attacks owing to lack or insufficient security, where industrial communication protocols represent a major attack surface. OPC UA is used in SCADA and automation systems to facilitate data exchange between devices at different architectural levels. Although this protocol has built-in security, it is still challenging to deploy security policies based on RSA primitives in complex architectures while ensuring interoperability. In many cases, they are deactivated in constrained devices. We propose several novel approaches for the integration of pairing-based cryptographic primitives into OPC UA to provide authentication and integrity for data exchanged through client-server-based mechanisms for PLC-to-SCADA/PLC communication. The proposed concept employs BLS signatures extending the ECDSA-based method from our previous work, leverages the advantages of BLS aggregated signatures for an automation/SCADA system scenario, and presents a baseline performance evaluation of a tripartite DH key exchange between PLCs. We implemented the methods and evaluated performance across different security levels by conducting measurements on an experimental setup that included an industrial PLC. We show that BLS-based methods offer robust and efficient security enhancement and are suitable for extending the OPC UA security profiles by complying with industrial PLC timing requirements (worst-case aggregated-signature latency overhead of 40.785 ms, jitter of 2.901 ms, and execution times below 50 ms and within 150-500 ms for 192-bit and 256-bit security, respectively), whereas tripartite DH indicates performance and security limitations. Additionally, we conducted a man-in-the-middle (MITM) attack, showing that the extended BLS methods are resilient against it.