Industrial device scanners allow anyone to scan devices on private networks and the Internet. They were intended as network security tools, but they are commonly exploited as attack tools, as scanning can reveal vulnerable devices. However, from a defensive perspective, this vulnerability disclosure could be used to secure devices if characteristics such as type, model, manufacturer, and firmware could be identified. Automated scanning reports can help to apply security measures before an attacker finds a vulnerability. A complete device recognition procedure can then be seen as the basis for auditing networks and identifying vulnerabilities to mitigate cyber-attacks, especially among Industrial Internet of Things (IIoT) devices that are part of critical systems. In this survey, considering SCADA (Supervisory Control and Data Acquisition) systems as monitoring and control components of essential infrastructure, we focus on analyzing the architectures, specifications, and constraints of several industrial device scanners. In addition, we examine the information revealed by the scanners to identify the threats posed by them on industrial systems and networks. We analyze monthly and yearly statistics of cyber-attack incidents to investigate the role of these scanners in accelerating attacks. By presenting the findings of an experimentation, we highlight how easily anyone could identify hundreds of Internet-connected industrial devices in Sweden, which could lead to a major service interruption in industrial environments designed for minimal human involvement. We also discuss several methods to avoid scanners or reduce their identifying capabilities to conceal industrial devices from unauthorized access.

Virtual Private LAN Service (VPLS) is a VPN technology that connects remote client sites with provider networks in a transparent manner. Session key-based HIPLS (S-HIPLS) is a VPLS architecture based on the Host Identity Protocol (HIP) that provides a secure VPLS architecture using a Key Distribution Center (KDC) to implement security mechanisms such as authentication, encryption etc. It exhibits limited scalability though. Using multiple distributed KDCs would offer numerous advantages including reduced workload per KDC, distributed key storage, and improved scalability, while simultaneously eliminating the single point of failure of S-HIPLS. It would also come with the need for optimally placing KDCs in the provider network. In this work, we formulate the KDC placement (KDCP) problem for a secure VPLS network as an Integer Linear Programming (ILP) problem. The latter is NP-hard, thereby suggesting a high computational cost for obtaining exact solutions especially for large deployments. Therefore, we motivate the use of a primal-dual algorithm to efficiently produce near-optimal solutions. Extensive evaluations on large-scale network topologies, such as the random Internet graph, demonstrate our method’s time-efficiency as well as its improved scalability and usefulness compared to both HIPLS and S-HIPLS.

Virtual Private LAN Service (VPLS) is commonly used for secure multi-point communication across geographically scattered industrial sites, simulating a unified LAN broadcast domain for Industrial IoT (IIoT)-type devices. This configuration demands a fully-connected overlay network with encrypted Host Identity Protocol (HIP)/IPsec tunnels exhibiting quadratic scalability to the number of tunnels and a significant increase in forwarding table entries. Herein, we introduce Tunnel Relay Nodes (TRNs) as selected routers that maintain full-mesh connectivity. This approach allows non-TRN routers, or Provider Equipment (PEs) acting as spoke PEs, to connect via a TRN. We explore the challenges of using TRNs in secure HIP-based VPLS (HIPLS) networks, including (i) placing reliable TRNs within provider networks and (ii) scheduling TRNs to minimize their activation/deactivation costs as well as the connection cost among PEs. We then demonstrate how (i) can be addressed in polynomial time using a modified general median problem approach. Additionally, we formulate (ii) as a Mixed Integer Linear Programming (MILP) scheduling problem and prove its NP-completeness. Furthermore, we introduce an algorithm based on Lagrangian relaxation to address the intractability in large-scale deployments. This algorithm offers fast, near-optimal solutions while simultaneously balancing solution quality and execution time. Our simulations on three real-world network topologies with real network demands show a 92% average reduction in forwarding table entries on PE. Compared to existing solutions, our method reduces the number of tunnels established by up to 95%, at the expense of a 1.39-fold increase in tunnel path length.

A sharp increase in cyberattacks targeting industrialsystems highlights the need for remote connectivity that remainssecure even as deployments scale across many sites. While VirtualPrivate LAN Service (VPLS) offers efficient and logically isolatedLayer 2 VPNs for industrial and enterprise deployments, currentsolutions operate under the assumption that customer sites fullytrust the provider infrastructure to enforce security. This trustmodel creates a single point of failure, placing the security andprivacy of customer networks at risk in the event of provider-sidebreaches, misconfigurations, or malicious activity. This paper introduces a scalable, Zero Trust architecture for Layer 2 ProviderProvisioned VPNs (PPVPNs) that eliminates the need to trustprovider edge (PE) routers. We propose enhancements to theHost Identity Protocol (HIP) through a multiparty key agreementmechanism, integrated into a modified HIP base exchange (HIPMBEX), which enables integrity protection and authenticationamong participating routers without requiring customers totrust the provider network. Our HIP-MBEX also incorporatesmechanisms to detect and eliminate malicious PE routers duringgroup key generation. To address scalability bottlenecks inHIP-based VPLS, we adopt a hub-and-spoke relaying designthat minimizes control plane overhead and reduces memoryfootprint in PE routers. The proposed architecture is evaluatedusing real-world network topologies and traffic demand matricesfrom operational networks. Experimental results show that HIPMBEX scales efficiently, maintaining setup latency below 200ms for mid-scale deployments, and reaches 1.7 seconds whenscaled to large deployments of 100 nodes. Compared to existingsecure VPLS solutions, our design reduces control plane signalingoverhead from 10.6 MB to 26 KB at 100 nodes. Additionally,the use of group-based security associations lowers per-packetcryptographic costs and memory footprint at PE routers. On thedata plane, HIP-MBEX keeps latency close to the IP baselineand reduces end-to-end latency by 8.3% on average comparedto current HIP-based solutions.