TY - CHAP A1 - Frauenschläger, Tobias A1 - Dentgen, Manuel A1 - Mottok, Jürgen T1 - Systemarchitektur eines Sicherheitsmoduls im Energiesektor T2 - Tagungsband 2. Symposium Elektronik und Systemintegration ESI 2020: "Intelligente Systeme und ihre Komponenten: Forschung und industrielle Anwendung" N2 - Aufgrund der immer weiter anwachsenden Vernetzung der Stromnetze wird die Kommunikation zwischen der Leitstelle des Energieversorgers und den Infrastrukturkomponenten innerhalb eines Umspannwerks immer bedeutsamer. Dabei werden sowohl Steuerbefehle als auch Daten für Überwachungsfunktionen übertragen. In den aktuellen Netzwerkarchitekturen findet diese Kommunikation ohne eine kryptografische Absicherung statt, was einen Angriffspunkt für gezielte Attacken und damit eine potenzielle Gefährdung der Energieversorgung darstellt. Um solchen Angriffen in Zukunft entgegenzuwirken, wird das ES³M-Sicherheitsmodul entwickelt. Dieses soll in das Netzwerk zwischen den beiden Kommunikationspartnern eingesetzt werden und so den Datenverkehr absichern. Mithilfe einer Bedrohungsanalyse wurden Anforderungen abgeleitet, die neben kryptografischen Maßnahmen auch Themen wie funktionale Sicherheit und Langlebigkeit umfassen. Um diese zu erfüllen, wurde eine spezielle Systemarchitektur auf Basis einer Aufgabenteilung entworfen. Diese Architektur und korrespondierende Designentscheidungen werden präsentiert. Y1 - 2020 U6 - http://nbn-resolving.de/urn/resolver.pl?urn:nbn:de:bvb:860-opus4-2092 N1 - Die Konferenzveröffentlichung erschien im Band "Fachbeiträge 2. Symposium Elektronik und Systemintegration ESI 2020" mit dem Titel „Intelligente Systeme und ihre Komponenten: Forschung und industrielle Anwendung“. Die Fachtagung, geplant für den 01. April 2020 an der Hochschule Landshut, wurde aufgrund der Corona-Pandemie abgesagt, die eingereichten Fachbeiträge im Band veröffentlicht. Hrsg.: Artem Ivanov, Marc Bicker und Peter Patzelt. Hochschule Landshut, 2020, ISBN 978-3-9818439-4-1 SP - 29 EP - 38 CY - Landshut ER - TY - CHAP A1 - Münch, Andreas A1 - Frauenschläger, Tobias A1 - Mottok, Jürgen T1 - Integration of a Security Gateway for Critical Infrastructure into Existing PKI Systems T2 - 3. Symposium Elektronik und Systemintegration (ESI 2022), Tagungsband: 06. April 2022, Hochschule Landshut, Deutschland Y1 - 2022 SN - 978-3-9818439-7-2 SP - 88 EP - 97 PB - Hochschule Landshut CY - Landshut ER - TY - CHAP A1 - Frauenschläger, Tobias A1 - Renner, Sebastian A1 - Mottok, Jürgen T1 - Security Improvements by Separating the Cryptographic Protocol from the Network Stack onto a Multi-MCU Architecture T2 - Architecture of Computing Systems - ARCS 2020: 33rd international conference, Aachen, Germany, May 25-28, 2020, proceedings N2 - The number of IoT devices in SCADA and ICS systems is rising quickly, especially in the domain of critical infrastructures. But these kinds of systems are performing mission critical tasks like controlling devices in industrial facilities or substations in the smart grid. Therefore, they are subject to a lot of regulatory standards. Yet, to provide remote access over the internet, special architectures are developed to integrate a network interface into these devices without inferring with the actual functionality. However, these architectures either lack security measures against cyber-attacks or do not offer the necessary performance for time-critical communication interfaces. To solve that, an architecture consisting of three units is introduced in this paper to provide a network interface with extensive security measures and a high performance. The main feature is the isolation of the cryptographic functionality onto an additional MCU. After proposing the basic concept, the paper presents many implementation details. Based on the current state of implementation, a concept validation of the realized architecture is described. KW - Cyber-security KW - Functional safety KW - Network security KW - Industrial Internet of Things KW - Industrial Control System KW - Supervisory Control and Data Acquisition System Multi microcontroller setup Dos prevention Critical infrastructures KW - Multi microcontroller setup Dos prevention Critical infrastructures KW - Dos prevention KW - Critical infrastructures Y1 - 2020 U6 - https://doi.org/10.1007/978-3-030-52794-5_14 SP - 185 EP - 199 PB - Springer International Publishing ER - TY - CHAP A1 - Frauenschläger, Tobias A1 - Mottok, Jürgen T1 - Security-Gateway for SCADA-Systems in Critical Infrastructures T2 - 27th International Conference on Applied Electronics (AE): 06-07 September 2022, Pilsen, CZ N2 - Supervisory Control and Data Acquisition (SCADA) systems are used to control and monitor components within the energy grid, playing a significant role in the stability of the system. As a part of critical infrastructures, components in these systems have to fulfill a variety of different requirements regarding their dependability and must also undergo strict audit procedures in order to comply with all relevant standards. This results in a slow adoption of new functionalities. Due to the emerged threat of cyberattacks against critical infrastructures, extensive security measures are needed within these systems to protect them from adversaries and ensure a stable operation. In this work, a solution is proposed to integrate extensive security measures into current systems. By deploying additional security-gateways into the communication path between two nodes, security features can be integrated transparently for the existing components. The developed security-gateway is compliant to all regulatory requirements and features an internal architecture based on the separation-of-concerns principle to increase its security and longevity. The viability of the proposed solution has been verified in different scenarios, consisting of realistic field tests, security penetration tests and various performance evaluations. KW - Critical Infrastructure KW - Certification KW - Supervisory Control and Data Acquisition KW - Security KW - Dependability Y1 - 2022 U6 - https://doi.org/10.1109/AE54730.2022.9920070 PB - IEEE ER - TY - CHAP A1 - Frauenschläger, Tobias A1 - Mottok, Jürgen T1 - Problems and New Approaches for Crypto-Agility in Operational Technology T2 - 12th European Congress Embedded Real Time Systems (ERTS 2024), 11-12 June 2024, Toulouse, France N2 - In recent years, cybersecurity has also become relevant for Operational Technology (OT). Critical systems like industrial automation systems or transportation systems are faced with new threats, and therefore require the implementation of thorough security measures. Regulations further mandate the deployment and regular verification of these security measures. However, OT systems differ from well-known systems of classic Information Technology (IT), such as mission times spanning decades, infrequent updates only during on-site maintenance, or diverse devices with varying support for security measures. The growing field of crypto-agility examines approaches to integrate security measures in an agile and flexible way, making updates easier and, therefore, encouraging a more frequent deployment of them. This paper contributes to this research field in the context of secure communication in two ways. We first examine the current state of crypto-agility by providing an overview of existing measures for OT systems. Then, we propose a new architecture concept with different deployment approaches to integrate security measures in a crypto-agile way. Based on a security library with a generic interface and a flexible proxy application, our architecture is capable of securing both new OT systems and existing ones via retrofit. Y1 - 2024 UR - https://www.researchgate.net/publication/383709526_Problems_and_New_Approaches_for_Crypto-Agility_in_Operational_Technology ER - TY - CHAP A1 - Schwind, Philipp A1 - Frauenschläger, Tobias A1 - Mottok, Jürgen T1 - Implementation of a Bump-in-the-Wire Security Gateway T2 - Proceedings of the 12th Prague Embedded Systems Workshop, June 27 - 29, 2024, Horoměřice, Czech Republic N2 - In the face of escalating cyber threats, the integration of Operational Technology (OT) with Information Technology (IT) systems presents heightened vulnerabilities to critical infrastructures. This paper focuses on the need for cybersecurity, showcasing the design and implementation of a security gateway to achieve bump-in-the-wire security between two units to be protected (assets). For that, each asset is assigned one security module that safeguards its communication paths. To ease bump-in-the-wire capability, the communication between the asset and the security-gateway must be stateless and operate on OSI layer 2. This is necessary to safeguard the whole communication bandwidth, regardless of the used protocols. For this objective, Linux-based packet sockets are used. An encrypted tunnel is established between two security gateways using the Datagram Transport Layer Security (DTLS) protocol. The results show that the implemented solution is capable of securing the asset’s network traffic without the need of any modifications. Y1 - 2024 UR - https://pesw.fit.cvut.cz/2024/PESW_2024.pdf SN - 978-80-01-07303-2 SP - 26 EP - 35 ER - TY - CHAP A1 - Horn, Luca A1 - Frauenschläger, Tobias A1 - Mottok, Jürgen T1 - Integration and Evaluation of Different FPGA based Hardware Accelerators for the AES Algorithm in the TLS Protocol to be Used in Critical Automation Systems T2 - 4. Symposium Elektronik und Systemintegration, Tagungsband: Symposium am 17. April 2024 Hochschule Landshut N2 - This thesis addresses the challenges of hardware-assisted cryptography in the context of automation systems in critical infrastructures. While hardware accelerators enhance cryptographic calculations in both performance and security, their permanence poses issues in adapting to evolving security concerns. To overcome this problem, we integrated and evaluated a hardware accelerator for the AES algorithm on an FPGA within a TLS application, comparing its performance with other accelerators. Employing a hybrid FPGA-CPU processor system, this setup achieves over 800 Mbit/s data rates, showcasing a more than 27 times acceleration in TLS transmissions compared to purely software-based solutions. The FPGA's flexibility and upgradability therefore make it an ideal platform for critical infrastructure, ensuring longevity and superior acceleration in TLS data transfers. Y1 - 2024 UR - https://www.haw-landshut.de/static/ITZ/Bilder/Cluster_MST/ESI_Symposium/ESI_2024/Tagungsband/1B2_Frauenschlaeger_OTH-R_TB-ESI2024_s18-27.pdf SN - 978-3-9818439-9-6 SP - 18 EP - 27 PB - Hochschule Landshut CY - Landshut ER - TY - CHAP A1 - Alhulaibi, Ayham A1 - Frauenschläger, Tobias A1 - Mottok, Jürgen T1 - Towards Post-Quantum-Ready Automated Certificate Lifecycle Management in Operational Technology T2 - SECURWARE 2025, The Nineteenth International Conference on Emerging Security Information, Systems and Technologies, 26.-30.10.2025, Barcelona N2 - Operational Technology (OT) systems increasingly depend on robust and automated certificate lifecycle management to maintain secure operations across long device lifespans and constrained environments. As quantum-capable adversaries emerge, these systems must also support cryptographic agility and prepare for a seamless transition to Post-Quantum Cryptography (PQC). This work presents a crypto-agile, post-quantum-ready testbed architecture that extends existing standards, such as Enrollment over Secure Transport (EST) and Bootstrapping Remote Secure Key Infrastructure (BRSKI), to support hybrid certificates, hardware-based key storage, and protocol flexibility for device bootstrapping and certificate management. A work-in-progress prototype implementation demonstrates support for both traditional and PQC algorithms across device types. Planned evaluations target performance on constrained devices, PQC readiness, and compatibility with alternative protocols. The system lays a foundation for secure and standards-compliant certificate management in future-proof OT deployments. KW - Automated Device Onboarding KW - BRSKI KW - Operational Technology Security. KW - Post-Quantum Cryptography KW - Public Key Infrastructure KW - Security Token Y1 - 2025 UR - https://www.thinkmind.org/library/SECURWARE/SECURWARE_2025 SN - 978-1-68558-306-4 SP - 112 EP - 116 PB - IARIA ER -