Refine
Document Type
- Conference Proceeding (9)
- Article (5)
- Report (1)
Language
- English (15) (remove)
Has Fulltext
- yes (15)
Is part of the Bibliography
- no (15)
Keywords
- Energiemanagement (5)
- Ethernet (5)
- PROFInet (5)
- Energieeffizienz (4)
- Computersicherheit (3)
- Ethernet-APL (3)
- PROFINET Security (3)
- energy management (3)
- IT Security (2)
- OT Security (2)
Institute
- Fakultät I - Elektro- und Informationstechnik (15) (remove)
In industrial production facilities, technical Energy Management Systems are used to measure, monitor and display energy consumption related information. The measurements take place at the field device level of the automation pyramid. The measured values are recorded and processed at the control level. The functionalities to monitor and display energy data are located at the MES level of the automation pyramid. So the energy data from all PLCs has to be aggregated, structured and provided for higher level systems. This contribution introduces a concept for an Energy Data Aggregation Layer, which provides the functionality described above. For the implementation of this Energy Data Aggregation Layer, a combination of AutomationML and OPC UA is used.
The PROFINET protocol has been extended in the current version to include security functions. This allows flexible network architectures with the consideration of OT security requirements to be designed for PROFINET, which were not possible due to the network segmentation previously required. In addition to the manufacturers of the protocol stacks, component manufacturers are also required to provide a secure implementation in their devices. The necessary measures go beyond the use of a secure protocol stack. Using the example of an Ethernet-APL transmitter with PROFINET communication, this article shows which technical and organizational conditions will have to be considered by PROFINET device manufacturers in the future.
PROFINET Security: A Look on Selected Concepts for Secure Communication in the Automation Domain
(2023)
We provide a brief overview of the cryptographic security extensions for PROFINET, as defined and specified by PROFIBUS & PROFINET International (PI). These come in three hierarchically defined Security Classes, called Security Class 1, 2 and 3. Security Class 1 provides basic security improvements with moderate implementation impact on PROFINET components. Security Classes 2 and 3, in contrast, introduce an integrated cryptographic protection of PROFINET communication. We first highlight and discuss the security features that the PROFINET specification offers for future PROFINET products. Then, as our main focus, we take a closer look at some of the technical challenges that were faced during the conceptualization and design of Security Class 2 and 3 features. In particular, we elaborate on how secure application relations between PROFINET components are established and how a disruption-free availability of a secure communication channel is guaranteed despite the need to refresh cryptographic keys regularly. The authors are members of the PI Working Group CB/PG10 Security.
Operators of production plants are increasingly emphasizing secure communication, including real-time communication, such as PROFINET, within their control systems. This trend is further advanced by standards like IEC 62443, which demand the protection of realtime communication in the field. PROFIBUS and PROFINET International (PI) is working on the specification of the security extensions for PROFINET (“PROFINET Security”), which shall fulfill the requirements of secure communication in the field.
This paper discusses the matter in three parts. First, the roles and responsibilities of the plant owner, the system integrator, and the component provider regarding security, and the basics of the IEC 62443 will be described. Second, a conceptual overview of PROFINET Security, as well as a status update about the PI specification work will be given. Third, the article will describe how PROFINET Security can contribute to the defense-in-depth approach, and what the expected operating environment is. We will evaluate how PROFINET Security contributes to fulfilling the IEC 62443-4-2 standard for automation components.
Two of the authors are members of the PI Working Group CB/PG10 Security.
With the use of an energy management system in an industrial company according to ISO 50001, a step-by-step increase in energy efficiency can be achieved. The realization of energy monitoring and load management functions requires programs on edge devices or PLCs to acquire the data, adapt the data type or scale the values of the energy information. In addition, the energy information must be mapped to communication interfaces (e.g. based on OPC UA) in order to convey this energy information to the energy management application. The development of these energy management programs is associated with a high engineering effort, because the field devices from the heterogeneous field level do not provide the energy information in standardized semantics. To mitigate this engineering effort, a universal energy data information model (UEIM) is developed and presented in this paper.
This paper reflects the content of the presentation “The Next Generation: Ethernet-APL for Safety Systems” at the NAMUR Annual General Meeting 2022. It deals with the use of the Ethernet Advanced Physical Layer (Ethernet-APL) in combination with the PROFINET/PROFIsafe protocol for safety applications. It describes the virtues of the digital communication between the field and safety system. In parallel the aspect of OT security for this use case is touched as well. The paper proposes a secure architecture, where safety- and non-safety field communications are still separated. At the end a set of requirements for the development of future APL devices is described.
Network convergence is an increasing trend in the automation domain. More and more plant owners strive for a unification of networks in their plants. This yields a seamless network structure, simplified supervision, and reduced training effort for the personnel, as only one unified network technology needs to be handled. Ethernet-APL is one piece of the puzzle for such a converged network, supporting various real time protocols like PROFINET, EtherNet, HART-IP as well as the middleware protocol OPC UA. This paper gives an overview on the impact of Ethernet-APL field devices to OT security and proposes how to ensure OT security for them.
The impact of vertical and horizontal integration in the context of Industry 4.0 requires new concepts for the security of industrial Ethernet protocols. The defense in depth concept, basing on the combination of several measures, especially separation and segmentation, needs to be complimented by integrated protection measures for industrial real-time protocols. To cover this challenge, existing protocols need to be equipped with additional functionality to ensure the integrity and availability of the network communication, even in environments, where possible attackers can be present. In order to show a possible way to upgrade an existing protocol, this paper describes a security concept for the industrial Ethernet protocol PROFINET.
Requirements for an energy data information model for a communication-independent device description
(2021)
With the help of an energy management system according to ISO 50001, industrial companies obtain the opportunities to reduce energy consumption and to increase plant efficiencies. In such a system, the communication of energy data has an important function. With the help of so-called energy profiles (e.g. PROFIenergy), energy data can be communicated between the field level and the higher levels via proven communication protocols (e.g. PROFINET). Due to the fact that in most cases several industrial protocols are used in an automation system, the problem is how to transfer energy data from one protocol to another with as less effort as possible. An energy data information model could overcome this problem and describe energy data in a uniform and semantically unambiguous way. Requirements for a unified energy data information model are presented in this paper.
In the area of manufacturing and process automation in industrial applications, technical energy management systems are mainly used to measure, collect, store, analyze and display energy data. In addition, PLC programs on the control level are required to obtain the energy data from the field level. If the measured data is available in a PLC as a raw value, it still has to be processed by the PLC, so that it can be passed on to the higher layers in a suitable format, e.g. via OPC UA. In plants with heterogeneous field device installations, a high engineering effort is required for the creation of corresponding PLC programs. This paper describes a concept for a code generator that can be used to reduce this engineering effort.