Encryption And Data Security - Siemens SIMATIC NET System Manual

Basics of communication with Industrial Ethernet
1.5 Wireless LAN
Requirement
● The access points are members of the same mobility domain
● Only possible with WPA2 encryption (WPA2-PSK and WPA2 RADIUS)
1.5.7

Encryption and data security

WPA2 and AES ("Advanced Encryption Standard")
WPA2 is seen as a standard today and differs from WPA essentially in the encryption
method: The weaknesses identified in WPA no longer exist in the AES method used in
WPA2.
When a "sensible" password is selected that is adequately long and cannot be guessed at,
AES encrypted messages count as being safe from eavesdropping according to today's
state of the art.
WPA ("Wi-Fi Protected Access")
WPA is the further development of WEP. Apart from technical modifications in the actual
encryption algorithm, the protocol was also adapted:
● Passwords for network access (authentication) are stored on a central server
("RADIUS"),
● The key for frame transmission changes dynamically making statistical attacks more
difficult,
● The MAC address is worked into the key (in other words, unique hardware identification)
of the sender making it more difficult to falsify the sender of the message.
WEP ("Wired Equivalent Privacy")
WEP is the oldest and at the same time the least secure encryption method with which
WLAN transmission is protected against unauthorized intruders according to the 802.11
standard.
With this method, a user password is used as a key from which a series of pseudo random
numbers is generated. Each character of the frame to be transmitted is then encoded with
the next number of this series and is decoded at the receiver.
Today, WEP is considered insufficiently secure.
EAP ("Extensible Authentication Protocol")
The acronym EAP covers a wide framework of different authentication mechanisms for
network access. In other words, EAP is not an authentication method itself but describes the
mechanism according to which the client and server can agree on a method.
58
System Manual, 09/2019, C79000-G8976-C242-10
Industrial Ethernet