Industrial networks typically connect hundreds or thousands of sensors and actuators in industrial facilities, such as manufacturing plants, steel mills, and oil refineries. Although the typical industrial Internet of Things (IoT) applications operate at low data rates, they pose unique challenges because of their critical demands for reliable and real-time communication in harsh industrial environments. IEEE 802.15.4-based wireless sensor-actuator networks (WSANs) technology is appealing for use to construct industrial networks because it does not require wired infrastructure and can be manufactured inexpensively. Battery-powered wireless modules easily and inexpensively retrofit existing sensors and actuators in industrial facilities without running cables for communication and power. To address the stringent real-time and reliability requirements, WSANs made a set of unique design choices such as employing the Time-Synchronized Channel Hopping (TSCH) technology. These designs distinguish WSANs from traditional wireless sensor networks (WSNs) that require only best effort services. The function-based channel hopping used in TSCH simplifies the network operations at the cost of security. Our study shows that an attacker can reverse engineer the channel hopping sequences and graph routes by silently observing the transmission activities and put the network in danger of selective jamming attacks. The cracked knowledge on the channel hopping sequences and graph routes is an important prerequisite for launching selective jamming attacks to TSCH networks. To our knowledge, this article represents the first systematic study that investigates the security vulnerability of TSCH channel hopping and graph routing under realistic settings. In this article, we demonstrate the cracking process, present two case studies using publicly accessible implementations (developed for Orchestra and WirelessHART), and provide a set of insights.

中文翻译：

---

破解工业 TSCH 网络中的信道跳跃序列和图路由

工业网络通常连接工业设施中的成百上千个传感器和执行器，例如制造厂、钢厂和炼油厂。尽管典型的工业物联网 (IoT) 应用程序以低数据速率运行，但它们带来了独特的挑战，因为它们在恶劣的工业环境中需要可靠和实时的通信。基于 IEEE 802.15.4 的无线传感器-执行器网络 (WSAN) 技术对于构建工业网络很有吸引力，因为它不需要有线基础设施并且制造成本低廉。电池供电的无线模块可以轻松且廉价地改造工业设施中的现有传感器和执行器，而无需铺设用于通信和供电的电缆。为了满足严格的实时性和可靠性要求，WSAN 做出了一系列独特的设计选择，例如采用时间同步信道跳频 (TSCH) 技术。这些设计将 WSAN 与仅需要尽力而为服务的传统无线传感器网络 (WSN) 区分开来。TSCH 中使用的基于功能的信道跳频以安全为代价简化了网络操作。我们的研究表明，攻击者可以通过静默观察传输活动来对信道跳跃序列和图形路由进行逆向工程，并使网络处于选择性干扰攻击的危险之中。对信道跳变序列和图路由的破解知识是对 TSCH 网络发起选择性干扰攻击的重要前提。据我们所知，本文代表了第一个系统研究，调查了现实设置下 TSCH 信道跳变和图路由的安全漏洞。在本文中，我们演示了破解过程，展示了两个使用可公开访问的实现（为 Orchestra 和 WirelessHART 开发）的案例研究，并提供了一组见解。