PROFIBUS DP/PA Security

PROFIBUS (Process Field Bus) was developed in 1987 and remains the dominant fieldbus in European manufacturing, chemical, pharmaceutical, and process industries. It has two main variants: PROFIBUS DP (Decentralised Periphery) for fast cyclic data exchange in factory automation, and PROFIBUS PA (Process Automation) for intrinsically safe areas using two-wire bus-powered segments with IS barriers. Neither variant includes authentication or encryption.

Protocol Overview

PROFIBUS uses a token-passing master-slave protocol. DP masters (PLCs, DCS controllers) hold the token; slaves (drives, I/O modules) respond only to their master. The cyclic exchange (DP-V0) transfers process data every scan cycle; acyclic services (DP-V1, DP-V2) allow parameterisation and event handling.

Security Vulnerabilities

• No authentication — any device that wins the token can issue read/write commands to all slaves on the segment
• Physical access is sufficient — PROFIBUS RS-485 is a shared bus; tapping the cable with a PROFIBUS analyser provides full bidirectional access
• No encryption — all process data (setpoints, drive speeds, sensor values) is in cleartext
• Address spoofing — PROFIBUS addresses (0–127) are configured in hardware/software; an attacker on the bus can impersonate any address
• Denial of service — injecting frames that corrupt the token rotation causes bus contention and communication loss

PROFIBUS to PROFINET Migration

New installations increasingly use PROFINET (Industrial Ethernet) rather than PROFIBUS RS-485. However, PROFIBUS PA segments remain common in chemical and pharmaceutical plants due to intrinsic safety requirements — IS-certified Ethernet solutions (APL — Advanced Physical Layer) are only beginning to appear.

Defences