Technical Paper Abstract
Securing EtherNet/IP endpoints cannot rely only on perimeter controls. Firewalls, segmentation, VPNs, and (D)TLS protect communication channels, but they do not by themselves decide whether a specific CIP object, service, or operational command is authorized for a given requester in the device’s current state or mode.
This paper proposes a fail-closed, post-(D)TLS endpoint enforcement pipeline for EtherNet/IP devices that composes with CIP Security rather than replacing it. After session establishment, the contribution is to enforce header or metadata inspection (L1), session binding validation (L2), operational-mode gates (L3), and CIP object or service authorization (L4) before the CIP Object Handler executes.
Keywords
EtherNet/IP, Common Industrial Protocol (CIP), CIP Security, industrial device security, device-level authentication, session validation, state validation, access control, mutual agreement, Volume 8, object-level policy, operational-mode gates, interoperability.
Paper and presentation from the 2026 ODVA Industry Conference & 24th Annual Meeting: to be published November 2
Shyam Sundar Pal, Firmware Architect, Utthunga Technologies
Riya Rahul Shah, Senior Functional Safety Lead, Utthunga Technologies