HART-IP Security
HART-IP is the network adaptation of the HART (Highway Addressable Remote Transducer) protocol, enabling HART device access over TCP/UDP infrastructure. Standardised by the FieldComm Group in 2012, HART-IP uses port 5094 (TCP) and port 5094 (UDP) to multiplex communication with multiple HART field devices through a HART-IP server (typically a wireless gateway or multiplexer).
HART-IP extends the reach of traditional HART instrument management to plant-wide asset management systems (AMS), allowing configuration, diagnostics, and calibration of field instruments over the control network without physical access to each device.
Architecture
A HART-IP Server (gateway/multiplexer) connects to HART devices via 4-20mA loops or WirelessHART. It exposes these devices to HART-IP Clients (AMS software, SCADA adapters) over the plant IP network. One HART-IP server can expose dozens of field instruments simultaneously.
| Component | Role | Exposure |
|---|---|---|
| HART-IP Server | Multiplexer bridging HART ↔ IP | Port 5094 on plant IP network — single point of access to all connected instruments |
| HART-IP Client | AMS software or SCADA adapter | Issues HART commands to instruments via server |
| WirelessHART Gateway | IEC 62591 wireless mesh → HART-IP | Additional wireless attack surface |
Security Vulnerabilities
- Single point of failure — one HART-IP server exposes all connected HART instruments; compromising the server gives access to every instrument on its loops
- Optional authentication only — HART-IP defines a challenge-response authentication mechanism but it is not mandatory and is rarely deployed
- No encryption — HART commands (including trim/calibration) transmitted in plaintext over TCP/UDP
- Sensor calibration attacks — write access to HART devices enables trim manipulation — shifting sensor calibration to cause process controllers to act on falsified measurements
- WirelessHART exposure — WirelessHART uses AES-128 encryption and 802.15.4 DSSS but weak join keys or default network IDs can be exploited
- Port 5094 scanning — actively scanned by threat actors as an indicator of accessible field instrumentation
HART-IP Authentication
HART-IP version 1 defines an optional challenge-response authentication sequence before session establishment. The server issues a 4-byte random challenge; the client responds with an HMAC computed from the challenge and a pre-shared session key. Without this exchange (the default), the session is established anonymously. Most deployed HART-IP servers do not require authentication.
Defences
| Control | SR | Effect |
|---|---|---|
| Enable HART-IP authentication | SR 1.2 | Challenge-response before session establishment |
| Firewall port 5094 | SR 5.2 | Allow only AMS server IP to reach HART-IP servers |
| Separate AMS VLAN | SR 5.1 | Isolate instrument management traffic from control network |
| Audit calibration changes | SR 2.8 | Log all HART write commands for anomaly detection |
| WirelessHART join key rotation | SR 1.5 | Unique join keys per network, rotated annually |
Examine HART-IP session structure, instrument access patterns, and sensor calibration attack simulation in the interactive protocol lab.
Open HART-IP Protocol Lab →