Evaluation of the Secure PROFINET Application Relation Establishment Performance

With the advent of the cryptographic security ex-tensions for PROFINET Security Class 2/3, as specified by PROFIBUS & PROFINET International, there arises a signif-icant difference between the establishment of a conventional (insecure) and a secure application relation (AR). However, to the best of our knowledge, there is no study yet that numeralizes how much delay is induced by the computational and communication overhead of the secure AR establishment. Therefore, we study its performance by runtime measurements using an experimental hardware setup. We answer two research questions: (1) how much additional runtime delay is induced by the currently specified security extensions when performing a secure AR establishment, and (2) what is the impact of currently unspecified options to reduce this delay? In particular, we study the options to use the Extensible Authentication Protocol (EAP) with Transport Layer Security (TLS) for full handshakes and session resumption, version 1.2 and 1.3, certificate-based and pre-shared-key-based (PSK) ciphersuites, as well as EAP-PSK. We gain the insight that the currently specified extensions lead to a best case delay of 17.5 ms and a worst case delay of 288.6 ms for full handshakes and to 7.3 and 9.8 ms for resumed sessions. With the currently unspecified option to use pre-shared-key-based ciphersuites, yet providing perfect forward security, the best case delay for full handshakes is reduced by 25.7 % and the worst case delay by 91.1 %. With the currently unspecified EAP-PSK option, which does not provide PFS, the largest reduction is achieved by 78.4 and 98.7 % related to best and worst case full handshakes. The authors are members of the PROFINET Working Group CBIPG 10 Security.