© Siemens

27.03.2018

INDUSTRIE 4.0 - SECURE DIGITAL IDENTITIES CREATE TRUST

According to Industrie 4.0 experts, secure digital identities (SDIs) are the only way to ensure cybersecurity. VDMA members demonstrate what these are, where they can be used, and which technologies are currently in development.

By Nikolaus Fecht

© HomagThe automated and autonomous sharing of data between machines, systems and components is the life blood of Industrie 4.0. Data exchange between systems, data collection in centralized data clouds and the analysis of this data stand and fall with the degree of data integrity and availability. It is also important that decisions made by the systems involved can be clearly traced.

Blockchain not yet a solution

This is where secure digital identities come in. "Every network device that communicates via open networks requires a secure identity," says Oliver Winzenried, CEO and founder of Wibu-Systems AG in Karlsruhe. The main goal for Winzenried, who is also Chair of the VDMA Medical Technology working group, is to put in place the means to identify and authenticate individual objects and IT services (entities). According to him, digital identities created based on common and verifiable secure cryptographic data types are the future. In contrast, Winzenried estimates that technologies such as blockchain cannot be used in industrial applications in the long-term.

Export restrictions are avoidable

Oliver Winzenried © Wibu-Systems"One general problem lies in how the identities can be provided, managed and used across a company," explains Winzenried. "This still requires highly-centralized and often expensive infrastructures to deal with cryptographic keys and their certificates. Fixed functionality and restricted access to crypto functions can help avoid export restrictions." For example, the Federal Office for Economic Affairs and Export Control (BAFA) could provide a list of goods (AzG), which certifies that the key is not subject to an export permit due to the crypto note on the export list (AL).

Some users, in particular those at medium-sized companies, hope that SDIs can be introduced with the help of a centralized identity base. Experts are pursuing this, but Winzenried believes it is unlikely to be fulfilled. "The idea of a centralized identity base is not feasible, as there is not just one single type of identity," explains the CEO. "Non-European identity providers have a remedy for this problem, as their encryption procedures assign an individual and secure identity to a device or a service." Instead, the company from Karlsruhe is is promoting its universal technology for software providers, device manufacturers and mechanical and plant engineers, to protect users from manipulation and third-party cyber attacks.

The key to IT security

IUNO, the national reference project for IT security in Industrie 4.0, represents a major step forward for IT security. Coordinated by Homag Holzbearbeitungssysteme GmbH from Schopfloch and funded by the Federal Ministry of Education and Research (BMBF), it identifies threats and risks for intelligent factories, develops protective measures and implements them in four application cases. The furniture industry also benefits from the experience gained in this project. Kitchens, for example, are made up of individual pieces, making innovative enterprises in this market natural pioneers when it comes to Industrie 4.0 and already giving them valuable experience with cyber security due to high levels of connection.

Trustworthy authentication

Ernst Esslinger © HomagSDI is also an important tool for cyber security in this segment. Secure digital identities form the foundation for automated and autonomous data exchange - such as the autonomous connection of storage systems to the SAP computer to order new spare parts for machines. However, not every system should have access to similar actions, just as not every employee can simply order parts. The process also needs to be legally watertight, i.e. incontestable in a technical environment. The user should be able to clearly trace the decisions of the systems involved based on secure digital identities.

"However, companies must decide which topics are worth protecting before they introduce SDI," says Ernst Esslinger, Director Methods/Tools/Systems at Homag. "I recently heard from a kitchen manufacturer that the worst thing is not the theft of design data, but data manipulation. This can cause hold-ups in production, as all the drawers are suddenly a centimeter too short, for example. In contrast, an automobile manufacturer may find the way a cylinder head is processed worth protecting," explains Esslinger. A detailed analysis of the initial situation and a risk assessment must therefore be conducted before every cyber security measure.

Encrypting texts

In order to create the SDI, the company uses the public key infrastructure (PKI), which encrypts texts using a cryptographic procedure. The user can decode the code using a secret key that can be created from a public key. According to Esslinger, the blockchain procedure could be of interest in the future. In his view, the best option for secure communication would be to use interfaces based on the Open Platform Communications Unified Architecture (OPC UA), which is a worldwide standard used for communication in automation technology, independent of the manufacturer. The German Federal Office for Information Security (BSI) in Bonn has confirmed this. Cyber security is essentially an inherent element to OPC UA, as the architecture enables users to encrypt and sign data.

Bypassing the complicated approval procedure for exports

Technical issues are not the only stumbling block - legal questions also play a major role. One important topic is government export restrictions. Along with other companies and VDMA, industrial businesses like Homag are attempting to expand the exception list in order to avoid the complicated approval procedure for every export.

"We want to encrypt our systems securely," Esslinger explains. This does not work for complicated export regulations, however, as codes that are too strongly encrypted are not allowed. In addition, he says, there are many legal issues to be decided, such as what the customer must sign to ensure legal certainty when customer data is stored in the cloud. Laws do exist in this area, but there have not yet been any test cases. It is unclear when a usable identity base will be available for medium-sized companies in accordance with these framework conditions. "We need it by 2020 at the latest," says Esslinger. "I would ask software developers to have the first viable prototypes ready by the end of 2019."

Different technologies can be used for SDI

Dr. Wolfgang Klasen © Siemens"Many security functions use secure identities, for example to verify the identities of communication partners or as forgery-proof authentication for products," says Dr. Wolfgang Klasen, Head of Research Group for Embedded Security at Siemens AG in Munich. "The rule of thumb here is that the higher the overall security level needed, the higher the security level of the security identity needs to be." According to Klasen, many different technologies can be used here. These include cryptographic procedures, forgery-proof embedded digital labels and hardware features, and the inclusion of anti-counterfeiting identifiers, such as banknotes and product authenticity signs.

Users often do not have the required expertise

According to Klasen, there are already many ways to use secure identities for security-related applications. The factors that determine which technology is used are user-friendliness, cost and the risk in the specific application case. However, Klasen sees a problem here. "One obstacle for the use of secure identities appears to be a lack of knowledge among potential users, particularly those from medium-sized companies. Companies should offer training courses and further education on this topic to support the users." Siemens offers assessments and online training courses on industrial security in production, helping small and medium-sized companies in particular to detect threats and implement countermeasures.

Cyber security requirements are particularly high in the field of 3D printing. Users here take particular care that only authorized persons have access to the 3D printing data and that only the original data is used. Sponsored by the German Federal Ministry for Economic Affairs and Energy and coordinated by Dr. Martin Holland from the Hanover office of Darmstadt-based company Prostep AG, the Secure Additive Manufacturing Platform (SAMPL) joint project deals with this and many other security aspects relating to the subject of secure 3D printing.

Secure element: a safe for sensitive data

Dr. Martin Holland © ProstepSDI also plays a major role here, as the SAMPL project also deals with machines and computers that communicate with one another (M2M) and process business transactions. In this project, a printer, for example, can identify itself absolutely securely via a secure element - a chip that stores sensitive data and executes secure apps, such as payment apps. It functions as a safe and protects the contents (applications and data) from malware attacks in encrypted form. Holland, the Head of Strategy & Business Development, explains: "This type of M2M business process will become ever more common in the future, so it is vital that machines also receive digital identities."

Users can identify machines through the installation of secure elements or other clear machine indicators. "Clearly-defined states of the machines including software can be compared to the actual current state using hashes, which are digital fingerprints," explains Holland. "Using hashes helps machines identify one another in a handshake procedure and execute transactions." When spare parts are procured worldwide, for example, a 3D printer can identify itself using a secure element and then receives the encrypted data required for printing.

Smart contracts: license to print

Blockchain technology enables business processes to be conducted via smart contracts for these M2M procedures. Smart contracts are software codes that can be executed in the blockchain as technical support for contract fulfillment. For example, Holland says, ERP systems could trigger the printing order for a 3D printer, but the printer would only receive a license to print once it has paid a corresponding license fee via an electronic transaction.

"Integrity within the blockchain is excellent as it enables every party to verify who carried out which transaction and when. This information is also immutably documented in the blockchain." Unlike a central trust center, blockchain works using local trust. A trust center is a trustworthy third party that confirms the identities of the partners in electronic communication processes. Holland explains, "If the majority of the participants in the blockchain verify a transaction or an identity, then the information can be trusted."

Independent of clearing sites

The legal aspects of this type of transaction remain complicated, which is where Marco Müller-ter Jung, Partner at DWF Germany Rechtsanwaltsgesellschaft GmbH in Cologne, comes in. The specialist attorney for information technology law views the public key infrastructure as a system that is technologically established but not yet widespread, mainly due to its complex installation and operation. In comparison, although not widely used, the blockchain system promises simpler operation and independence from central providers and clearing sites. "It remains to be seen whether blockchain technology can guarantee the same level of security with regard to identifying and tracing explanations and actions," says Müller-ter Jung. According to him, the question of the security level provided by the blockchain depends on the implementation and devices used.

Personal traceability

Marco Müller-ter Jung © DWFThe legal aspects of SDI are also interesting. One example that Müller-ter Jung mentions is that US export control regulations can be applied when software is distributed via the app stores of large American providers, as all cryptographic technologies are subject to export control in the USA. European data protection law also applies to the use of SDI as soon as it is possible to identify a person. However, there has not yet been a final decision as to whether the classification as a "public directory", comparable to a telephone book with lower protection levels, can be a viable solution. "A transaction list can definitely be attributed to a specific person," explains the attorney. "In particular, the use of a blockchain in this context appears problematic from a legal standpoint, as it enables all transactions to be traced back to an individual person, or at least a wallet ID."

Identity base for SMEs not yet on the horizon

Müller-ter Jung believes that, although initial approaches for an identity base for small and medium-sized enterprises are in place, implementation will take time, not least with regard to the EU Regulation "Electronic Identification, Authentication and Trust Services (eIDAS)". "Because different systems are incompatible with each other, eIDAS is unlikely to have a significant effect in the next few years, as accreditation and notification procedures must first be completed. Technical implementation must also be reliable and easy for SMEs within Industrie 4.0," says Müller-ter Jung, with one eye on the future.

Further Information

VDMA Competence Center Industrial Security   |   VDMA Software and Digitalization   |   VDMAimpulse 02-2018: "Background: Secure digital identity (SDI)"   |   VDMAimpulse 02-2018: "Cyber crime causes damage running to millions of euros"   |   Homag   |   IUNO   |   Prostep   |   Siemens   |   Wibu-Systems  

© VDMA
Contact
Steffen Zimmermann, Head of VDMA Competence Center Industrial Security.