Hopper: Per-Device Nano Segmentation for the Industrial IoT

Abstract

Today's industrial networks heavily rely on perimeter-based security. Although this has worked well in the past, the advent of the industrial IoT is blurring the network boundary, and thereby undermining the effectiveness of perimeter-based network defences. To address this, we propose Hopper: an industrial IoT security protocol that places each network host in its own access-controlled nano segment, thus minimizing the attack surface introduced by connecting devices to the network. Because Hopper enforces nano segmentation in-fabric, it does not require modifications to how packets are routed. Hopper achieves this by allowing each network node to verify that each packet it processes is part of a desired flow and was generated by an authorized host. Packets that fail any of these checks are dropped en route. By leveraging prevalent industrial network features, Hopper accomplishes low management and bandwidth overhead while being suitable for a wide range of networks. Our implementation on IoT-class hardware demonstrates that Hopper achieves high throughput and scalability, even in constrained environments.