Wolfgang Granzer

Security in Building Automation Systems

Building automation systems are traditionally concerned with the control of heating, ventilation, and air conditioning, as well as lighting and shading, systems. They have their origin in a time where security has been considered as a side issue at best. Nowadays, with the rising desire to integrate security-critical services that were formerly provided by isolated subsystems, security must no longer be neglected. Thus, the development of a comprehensive security concept is of utmost importance. This paper starts with a security threat analysis and identifies the challenges of providing security in the building automation domain. Afterward, the security mechanisms of available standards are thoroughly analyzed. Finally, two approaches that provide both secure communication and secure execution of possibly untrusted control applications are presented.

Wireless Technologies in Home and Building Automation

The use of wireless technologies in automation systems offers attractive benefits, but introduces a number of new technological challenges. The paper discusses these aspects for home and building automation applications. Relevant standards are surveyed. A wireless extension to KNX/EIB based on tunnelling over IEEE 802.15.4 is presented. The design emulates the properties of the KNX/EIB wired medium via wireless communication, allowing a seamless extension. Furthermore, it is geared towards zero-configuration and supports the easy integration of protocol security.

Security in networked building automation systems

Enriching Building Automation Systems (BAS) with new services formerly provided by separate subsystems promises synergies, but increases demands on the BAS architecture. In particular, the integration of security subsystems significantly tightens security requirements on the protocol of a networked control system. First, this paper gives a survey on security in BAS. Possible threats and attacks are discussed. Weaknesses in the security mechanisms of important open networked BAS (LonWorks, BACnet, KNX/EIB) are summarized. Then, a security extension to KNX/EIB is presented. It includes several security mechanisms that guarantee data integrity, confidentiality and freshness, as well as authentication to provide secure process data and management communication. Relevant configuration related issues such as key management and distribution are also addressed.

Integration of heterogeneous building automation systems using ontologies

The challenge of integrating heterogeneous systems in order to combine their functionality is of utmost importance for the further deployment of building automation systems. The goal is to allow comprehensive communication among the systems. This will provide enhanced possibilities thus making way for intelligent buildings. Traditionally, integration is achieved using gateways which require considerable configuration effort. To alleviate this overhead and provide a unified system view, a generic application model is proposed that can accommodate all functionality found in building automation systems. The employment of this model promises several benefits such as a central point for configuration and system access. The method of choice are ontologies, which allow to offer a seminal representation of knowledge, an abstraction of the heterogeneous network infrastructure and automatic reasoning on the stored knowledge.

Interoperability at the management level of building automation systems: A case study for BACnet and OPC UA

In modern building automation systems a plethora of different networking technologies exists. Therefore, interoperability between devices using various technologies is a key requirement. The use of Web Services as a platform-and technological-independent method of communication is a promising approach to address this challenge. Since IP extensions to available technologies are more and more established in building automation systems the network infrastructure and necessary protocols for Web Services communication are already present. However, providing appropriate concepts to model information that can be accessed in a generic way are still missing. OPC Unified Architecture (OPC UA) is a powerful and promising standard that aims at solving this challenge. This work discusses an approach to map the interworking model of BACnet to OPC UA. Using the resulting information model BACnet applications can be represented in OPC UA and, thus, be accessed by OPC UA clients in a standard and well-defined way.

Denial-of-service in automation systems

Security aspects of todaypsilas automation systems gain increasing importance. One critical point regarding security is the exchange of control data over the network. Recently, cryptographic techniques have been developed that can protect the transmitted data against a malicious interference. However, there are security threats which cannot be prevented using cryptographic techniques. Typical representatives are denial-of-service (DoS) attacks. Therefore, this paper presents a novel, generic approach how such DoS attacks can be prevented or, if prevention is not possible, can be detected at least.

A modular architecture for building automation systems

The deployment of building automation systems (BAS) allows to increase comfort, safety and security and to reduce operational cost. Today such systems typically follow a two-layered hierarchical approach. While control networks interconnect distributed sensors, actuators and controllers, a backbone provides the necessary infrastructure for management tasks hosted by configuration and management devices. In addition, devices interconnecting the control network with the backbone and the backbone with further networks (e.g., the Internet) play a strategic role. All BAS devices contributing to a particular functionality differ in their requirements for hardware. This paper discusses requirements for devices used in the building automation domain and presents our work in progress to assemble platforms with different purposes relying on a modular architecture.

Information modeling in heterogeneous Building Automation Systems

Modern Building Automation Systems (BAS) are highly heterogeneous where often a plethora of technologies is necessary to satisfy the needs of all underlying application domains. On the way to “intelligent” buildings and smart control, a key challenge to be solved is interoperability at the information level. In order to use data in a technological-independent way, it must be possible to represent and access them in a generic way. One opportunity is to use the information modeling concepts provided by OPC Unified Architecture (OPC UA). Therefore, this paper is dedicated to information modeling of BAS using OPC UA. First, it is shown how interworking models of the open standards BACnet, KNX, LonWorks and ZigBee can be mapped to OPC UA. As a proof-of-concept, a management application based on the proposed OPC UA information models bridging the technologies BACnet and KNX is presented.

Key set management in networked building automation systems using multiple key servers

With the integration of security critical applications into traditional building automation systems, a comprehensive security concept is mandatory. Most important, transmitted data have to be secured using cryptographic techniques. However, even if the used cryptographic algorithms are perfectly secure, the overall security highly depends on the non-disclosure of the used shared secrets. Therefore, this paper targets the management of these shared secrets and the necessary infrastructure used to manage them. Finally, to eliminate a single point of failure in this infrastructure, a redundancy concept featuring multiple key servers is presented.

Gateway-free integration of BACnet and KNX using multi-protocol devices

Today, building automation systems can be realized using a multitude of different standards. Since each of these standards has its benefits, the combination of different standards and consequently of their best features promises substantial synergies. However, an integration is far from being straight forward and thus demands research. Starting from an analysis of the benefits that integrated building automation networks can offer, this work reviews the different approaches to combine KNX and BACnet. A gateway-free solution based on multi-protocol devices is considered most promising and examined in detail. The required protocol adaptations are discussed and, finally, a prototype implementation of an integrated, gateway-free BACnet/KNX internetwork is presented.