Inst ToolsInst ToolsInst Tools
  • Courses
  • Automation
    • PLC
    • Control System
    • Safety System
    • Communication
    • Fire & Gas System
  • Instrumentation
    • Design
    • Pressure
    • Temperature
    • Flow
    • Level
    • Vibration
    • Analyzer
    • Control Valve
    • Switch
    • Calibration
    • Erection & Commissioning
  • Interview
    • Instrumentation
    • Electrical
    • Electronics
    • Practical
  • Q&A
    • Instrumentation
    • Control System
    • Electrical
    • Electronics
    • Analog Electronics
    • Digital Electronics
    • Power Electronics
    • Microprocessor
  • Request
Search
  • Books
  • Software
  • Projects
  • Process
  • Tools
  • Basics
  • Formula
  • Power Plant
  • Root Cause Analysis
  • Electrical Basics
  • Animation
  • Standards
  • 4-20 mA Course
  • Siemens PLC Course
Reading: #5 PLC Best Practices – Cryptographic and Checksum Integrity Checks
Share
Notification Show More
Font ResizerAa
Inst ToolsInst Tools
Font ResizerAa
  • Courses
  • Design
  • PLC
  • Interview
  • Control System
Search
  • Courses
  • Automation
    • PLC
    • Control System
    • Safety System
    • Communication
    • Fire & Gas System
  • Instrumentation
    • Design
    • Pressure
    • Temperature
    • Flow
    • Level
    • Vibration
    • Analyzer
    • Control Valve
    • Switch
    • Calibration
    • Erection & Commissioning
  • Interview
    • Instrumentation
    • Electrical
    • Electronics
    • Practical
  • Q&A
    • Instrumentation
    • Control System
    • Electrical
    • Electronics
    • Analog Electronics
    • Digital Electronics
    • Power Electronics
    • Microprocessor
  • Request
Follow US
All rights reserved. Reproduction in whole or in part without written permission is prohibited.
Inst Tools > Blog > PLC Tutorials > #5 PLC Best Practices – Cryptographic and Checksum Integrity Checks

#5 PLC Best Practices – Cryptographic and Checksum Integrity Checks

Use cryptographic hashes, or checksums to check PLC program integrity and raise an alarm when they change.

Last updated: September 21, 2021 2:30 am
Editorial Staff
PLC Tutorials
1 Comment
Share
5 Min Read
SHARE

Use cryptographic hashes, or checksums if cryptographic hashes are unavailable, to check PLC code integrity and raise an alarm when they change.

Contents
ChecksumsHashesExampleSiemens Implementation ExampleRockwell Implementation Example
Security ObjectiveTarget Group
Integrity of PLC logicProduct Supplier Integration / Maintenance Service Provider Asset Owner

Checksums

Where (cryptographic) hashes are not feasible, checksums may be an option. Some PLCs generate a unique Checksum when code is downloaded into the PLC Hardware.

The Checksum should be documented by the manufacturer / integrator after SAT and be part of warranty / service-conditions.

If the checksum feature is not natively available in the controller, this can also be generated in the EWS/HMI and probed e.g., once a day to compare with the hash of the original code in the PLC to verify that they are matching. While this won’t provide real time alerts, it’s good enough to track if anyone is attempting changes to the PLC code.

The checksum value can also be moved into a PLC register and configured for an alarm when it changes, the value can be sent to historians etc.

Hashes

PLC CPUs generally do not have the processing capacity to generate or check hashes while running. Attempting a hash might actually cause the PLC to crash.

But the PLC’s engineering software might be able to calculate hashes from the PLC code and save them either in the PLC or somewhere else in the control system.

Use Cryptographic checks for PLC

Example

PLC vendors that are known to have checksum features:

  • Siemens (see example)
  • Rockwell

Also, external software can be used for generating checksums:

  • Version dog
  • Asset Guardian
  • PAS

Siemens Implementation Example

Example for creating checksums in Siemens S7-1500 PLC:

GetChecksum-Function Block reads actual checksum and with a lightweight script the “SAT- Checksum” can be stored as reference.

A deviance from the Reference-Checksum can be stored with the Datalog-Function.

Example for creating checksums in Siemens S7-1500 PLC

Rockwell Implementation Example

This is partial example of how an organization can develop a level of PLC program change detection capability within their ICS environment.

This example is specifically for a Rockwell Automation ControlLogix PLC and is not complete; however, it illustrates how to retrieve the PLC processor state into a register within the PLC.

Once in a register in the PLC, the organization can use it create a configuration change alarm for display on an HMI, transmit the raw state information to an HMI for trending and monitoring, or send it to a Historian for long term capture.

This practice provides an opportunity, using existing tools and capabilities, to gain situational awareness of when critical cyber assets change. It is up to the organization to complete the use of this example in a method that works best in their environment.

  1. From the Controller Properties Dialog Box, select the configure button on “Change to Detect”
  2. Within the selection window, choose all items to be monitored
  3. Create a Tag to receive the processor state information. This tag can be of type “LINT” or a 2-word array of type “DINT”
  4. Use the Get System Values (GSV) instruction to get the processor state information from memory and move it into a Tag that can be used in logic or read at the HMI

Why?

Beneficial for…?Why?
  SecurityKnowing if PLC code was tampered with is essential for both noticing a compromise and verifying if a PLC is safe to operate after a potential compromise.
  ReliabilityHashes or checksums can also be a means to verify if the PLC is (still) running code approved by the integrator/manufacturer.
Maintenance/

References

Standard / frameworkMapping
MITRE ATT&CK for ICSTactic:  TA002 – Execution, TA010 – Impair Process Control
Technique:  T0873 – Project File Infection, T0833 – Modify Control Logic
ISA 62443-3-3SR 3.4 : Software and information integrity
  ISA 62443-4-2CR 3.4 : Software and information integrity
EDR 3.12 : Provisioning product supplier roots of trust
  ISA 62443-4-1SI-1 : Security implementation review
SVV-1 Security requirements testing
  MITRE CWECWE-345: Insufficient Verification of Data Authenticity      
CWE-353: Missing Support for Integrity Check       
CWE-354: Improper Validation of Integrity Check Value

Source: PLC Security

Don't Miss Our Updates
Be the first to get exclusive content straight to your email.
We promise not to spam you. You can unsubscribe at any time.
Invalid email address
You've successfully subscribed !

Continue Reading

What is Distributed IO? – Decentralized Peripherals in PLC
Readings Mismatch between Field & Control Room ? Why
PLC Program for Positive Edge Pulse Output for One Scan Cycle
Programmable Logic Controller (PLC) Scan Time – Types, Theory
Allen Bradley RSLogix 500 PLC Programming
Split Range Control Application using PLC Ladder Logic
Share This Article
Facebook Whatsapp Whatsapp LinkedIn Copy Link
Share
1 Comment
  • Jason Jones says:
    March 16, 2023 at 12:14 am

    This functionality is built-in to Mitsubishi Electric iQ-R series PLC’s. The loaded firmware, parameterization, and programs/global tags can be monitored separately and in real-time using system memory of the CPU (SD2020-2025).

    Reply

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Stay Connected

128.3kFollowersLike
69.1kFollowersFollow
210kSubscribersSubscribe
38kFollowersFollow

Categories

Explore More

Motor ON OFF Logic in PLC
Functional Block Diagram PLC Example for Traffic Light System
4-20 mA Transmitter Wiring Types : 2-Wire, 3-Wire, 4-Wire
Difference Between Solid State Relay and Electromechanical Relay
PLC Raw Count Calculation for Pressure Transmitter
How to Retrieve PLC Project From Memory Card?
#19 PLC Best Practices – Monitor PLC Memory Usage
How to Design an Effective HMI? – Human Machine Interface

Keep Learning

HMI

Learn about SCADA and HMI Systems

Siemens Profibus Interface DP

How to Create New Project Using Simatic Manager

High-Speed and Fast Counters in PLC

What are High-Speed Counters and Fast Counters in PLC?

Function and Application of FIFO Block

How to use FIFO Block in TIA Portal? – Siemens PLC Programming

Tanks Draining Control in PLC using Functional Block Diagram

Tanks Draining Control in PLC using Functional Block Diagram

Schneider Electric Modicon M340 PAC

PLC vs PAC – Understanding the Key Differences and Similarities

Parameters of SRT_DINT instruction

Tia Portal – OB20 Time Delay Interrupt Organization Block

Difference between Motion Controller and PLC

Difference between Motion Controller and PLC

Learn More

Batteries Connected in Parallel

Battery Operation : Series and Parallel

full-wave-bridge-rectifier-with-voltage-regulator

Basics of Voltage Regulators

Limit, Selector, and Override controls

Limit, Selector, and Override controls

Download Free HMI software – CODESYS

Differential Pressure (DP) Flow Meters Range Calculation Methods

Differential Pressure (DP) Flow Meters Range Calculation Methods

Magnetostrictive Level Transmitter Working Principle

Magnetostrictive Level Transmitter Working Principle

Earth Meter Working Principle

How Earth Resistance is Measured

PLC Count values higher than 999

PLC Count values higher than 999

Menu

  • About
  • Privacy Policy
  • Copyright

Quick Links

  • Learn PLC
  • Helping Hand
  • Part Time Job

YouTube Subscribe

Follow US
All rights reserved. Reproduction in whole or in part without written permission is prohibited.
Welcome Back!

Sign in to your account

Username or Email Address
Password

Lost your password?