BACnet Secure Connect technical details
BACnet/SC is a security update to the BACnet standard. It is essentially a secure and IT friendly alternative to BACnet/IP. BACnet/SC maintains the well-known and desired BACnet features of compatibility to existing and future versions of BACnet protocol revisions accepted by the BACnet Testing Laboratory (BTL), system scalability and flexibility, as well as interoperability between different vendors who are BACnet-compliant with BACnet Testing Laboratory (BTL) listings and matching BACnet Interoperability Building Blocks (BIBBs) in the Protocol Implementation Conformance Statement (PICS) of the components comprising the BACnet system. BACnet/SC still uses the BACnet standard method of device/object identification using instance numbers (the BACnet device instance number and its respective object instance numbers). Since these unique identifiers are consistent regardless of the BACnet data link layer option used, there is no need to rediscover devices and their objects or recreate references, trends, schedules, and graphics in BACnet client devices when changing network configuration from BACnet/IP to BACnet/SC, or when routing from existing BACnet data links, such as BACnet/IP and BACnet MS/TP to BACnet/SC, which saves time on projects and allows for flexibility in data link layer options and a smooth transition to more secure OT networks with BACnet/SC.
Attribute | BACnet/IP | BACnet/SC |
|---|---|---|
Standardized data model for communication |
|
|
Interoperability between vendors with BTL listings and matching BIBBs in PICS |
|
|
Compatibility with existing and future versions of BACnet |
|
|
BACnet routing between different BACnet data links (BACnet/IP, BACnet MS/TP, BACnet/SC) |
|
|
Device Instance number and Object Instance numbers for device/object identification |
|
|
System scalability and flexibility |
|
|
While maintaining what is important and valuable in BACnet, there are also several improvements. BACnet/SC uses industry-standard and trusted technologies IT professionals are comfortable with and blends nicely into the mainstream IT landscape. BACnet/SC adds an encryption layer to communications and requires device authentication using certificates, which improves BACnet network security, even in unsecured environments. BACnet/SC also works easily with IP firewalls and Network Address Translation (NAT), and there are no more heavy broadcasts on the IP network.
BACnet/IP - Unsecured | BACnet/SC - Secure |
|---|---|
Connectionless UDP protocol | Connection-oriented TCP protocol |
Heavy broadcast traffic on the IP network | Unicast traffic (no heavy broadcast traffic on the IP network) |
No traffic encryption – all communication visible on the network | Traffic is end-to-end encrypted using mutual TLS v1.3 secured WebSocket communication |
No device authentication – any device can join the network | All devices authenticated using X.509v3 certificates before joining the network |
Requires BACnet Broadcast Management Device (BBMD) to get across IP subnets | Does not require BACnet Broadcast Management Device to get across IP subnets |
Does not work well with IP firewalls or Network Address Translation (NAT) | Works well with IP firewalls and Network Address Translation (NAT) |
Static IP addresses sometimes required | No static IP addresses required |
BACnet is located entirely in the Application space. BACnet/SC is a virtual datalink option that is directly added to the BACnet protocol stack under the BACnet Network Layer in the Application space. The upper BACnet layers, specifically the BACnet Application Layer and BACnet Network Layer, remain unchanged. This means that user side applications and workflows using BACnet are not affected. In addition, BACnet routing functionality can be leveraged to interconnect different BACnet data links, such as BACnet/SC, BACnet/IP, and BACnet MS/TP to form a BACnet Internetwork. What has changed is the necessity to generate, provision, and maintain digital certificates for the devices to mutually authenticate and handle the encrypted traffic, and a so-called logical ‘hub-and-spoke’ relational model to hierarchically structure the devices in a BACnet/SC logical network. Both changes are new to the operational workflows when setting up a project.
- BACnet/SC uses the same Physical Layer as BACnet/IP – Ethernet cabling, making data link layer changes between /IP and /SC purely firmware functions in the devices and a matter of software configuration.
- On the Link Layer, BACnet/SC is agnostic of Internet protocol (IP) version, and it can run over IPv4 and IPv6 (only IPv4 currently supported).
- On the Transport Layer, BACnet/SC no longer uses the connectionless UDP protocol which has been replaced by the industry standard connection-oriented Transmission Control Protocol (TCP). In contrast to UDP, TCP requires an established connection for transmitting data, guarantees delivery of data to the destination, allows for retransmission of lost packets, provides extensive error checking and acknowledgment of data, does not require broadcasting on the network, and improves support of IT-configured firewalls, Network Address Translation (NAT) devices, and other middlebox IT equipment.
- On the Application layer, BACnet/SC uses the WebSocket protocol for communication, making use of the well-known HTTP(S) ports, secured by mutual Transport Layer Security (TLS) v1.3 and X.509v3 certificates. The BACnet standard defines use of the sophisticated TLS v1.3 encryption standard, but other TLS versions, such as v1.2, are allowed for compatibility with lagging IT security appliances and policies.
- Optional Domain Name System (DNS) name resolution allows for dynamic IP addressing and independence from IP network structure.
- BACnet/SC has a high degree of freedom from its underlying IP subnet LANs:
- One BACnet/SC network can comprise several IP subnets
- One IP subnet can comprise several BACnet/SC networks