Trust Zone Formation for Building Automation Networks Using Building Information Modeling

Modern Building Automation Systems (BAS) consist of sensors and actuators that are connected via an IP-based network and offer their functionality via RESTful APIs. Because a single device can be exploited by an attacker to perform attacks within the local network, we put devices into isolated groups. These groups are isolated MAC-layer Trust Zones to reduce the attack surface in contrast to a BAS with fully connected devices. We propose an algorithm that leverages the so far neglected potential of Building Information Modeling (BIM) to compute Trust Zones. We assure unimpaired operation of all applications while limiting the number of infrastructure devices. The proposed mechanisms are demonstrated considering sensors and actuators that are connected via wired Ethernet and the IEEE 802.11s WLAN mesh standard. At the application layer we make exemplary use of the Constrained Application Protocol (CoAP). Finally, we experimentally evaluate the device acquisition and selection based on our network partitioning algorithm.