Historically, Industrial Automation and Control Systems (IACS) were largely isolated from conventional digital networks such as enterprise ICT environments. Where connectivity was required, a zoned architecture was adopted, with firewalls and/or demilitarized zones used to protect the core control system components. The adoption and deployment of ‘Internet of Things’ (IoT) technologies is leading to architectural changes to IACS, including greater connectivity to industrial systems. This paper reviews what is meant by Industrial IoT (IIoT) and relationships to concepts such as cyber-physical systems and Industry 4.0. The paper develops a definition of IIoT and analyses related partial IoT taxonomies. It develops an analysis framework for IIoT that can be used to enumerate and characterise IIoT devices when studying system architectures and analysing security threats and vulnerabilities. The paper concludes by identifying some gaps in the literature.

Introduction

The concept of Industrial Automation and Control Systems (IACS) is well established. These systems, often referred to as Operational Technology (OT), are employed in diverse industries including manufacturing, transportation and utilities, and are sometimes referred to as cyber-physical systems (CPS). Since the term Internet of Things (IoT) [1] was first used in 1999, it has been applied to connected devices in consumer, domestic, business and industrial settings [2]. Although there is a significant amount of literature attempting to define IoT, its uses, and its typical components, it is rarely made obvious how any of this applies in the industrial setting. Because current definitions of IoT invariably imply a similar approach to the high-level architecture of a system, the ubiquitous use of the term IoT to refer to the use of digital technologies in industry is unhelpful as it hinders the analysis of alternative system architectures, including the location and nature of the data or information processing, and associated performance and security issues. The aims of this paper are to improve on existing definitions of Industrial IoT (IIoT) and to propose a framework for IIoT components as a basis for analysing the use and deployment of IoT technologies in industrial settings. In undertaking this research our aim was to establish a framework that allows us to analyse the nature of IIoT devices and their uses, which is to be used as part of a vulnerability and threat analysis process for these devices. By being able to characterise the devices in a systematic manner, we anticipate being able to analyse cross-cutting threats and vulnerabilities and identify patterns that may be obscured when focusing on the technology employed or sector specific issues. This paper is structured as follows: Section 2 provides some further background to CPS, IACS, and the Industrial Internet, setting it against the background of Industry 4.0. Section 3 provides our analysis and definition of IIoT, which builds on existing explanations that are presented. Section 4 presents our framework. Finally, Section 5 identifies gaps in the current literature that need to be addressed in future work.