Replay-Attack Detection and Prevention Mechanism in Industry 4.0 Landscape for Secure SECS/GEM Communications

Starting from the First Industrial Revolution to the current and Fourth Industrial Revolution (or Industry 4.0), various industrial machines are present in the market and manufacturing companies. As standardized protocols have become increasingly popular, more utilities are switching to Internet Protocol (IP)-based systems for wide-area communication. SECS/GEM is one of the standards that permit industries to collect information directly from the machines, either using RS323 or TCP/IP communication. TCP/IP communication is becoming more critical than ever, especially given our accelerated digital transformation and increasing reliance on communication technologies. The growth of IT is accelerating with cyberthreats as well. In contrast, security features in the SECS/GEM protocol may be neglected by some companies as it is only used in factories and not mostly used in the outside world. However, communication of SECS/GEM is highly susceptible to various cyberattacks. This paper analyzes the potential replay-attack cyberattacks that can occur on a SECS/GEM system. In replay attacks, this paper supposes an adversary that wants to damage an operation-based control system in an ongoing condition. The adversary has the ability to capture messages to watch and record their contents for a predetermined amount of time, record them, and then replay them while attacking in order to inject an exogenous control input undetected. The paper's objectives are to prove that SECS/GEM communication is vulnerable to cyberattack and design a detection mechanism to protect SECS/GEM communications from replay attacks. The methodology implements a simulation of the replay-attack mechanism on SECS/GEM communication. The results indicate that the design mechanism detected replay attacks against SECS/GEM communications and successfully prevented them.