Refine
Year of publication
- 2023 (3)
Document Type
- Article (2)
- Conference Proceeding (1)
Has Fulltext
- yes (3)
Is part of the Bibliography
- no (3)
Keywords
- PROFINET Security (3)
- PROFInet (3)
- Computersicherheit (2)
- IEC 62443 (2)
- Automation (1)
- Kommunikation (1)
- Kryptologie (1)
- OT Security (1)
- Secure Development Lifecycle (1)
- Secure communication (1)
Institute
Das PROFINET Protokoll wurde in der aktuellen Version um Security-Funktionen erweitert. Damit können für PROFINET flexible Netzwerkarchitekturen unter Berücksichtigung von OT-Security Anforderungen entworfen werden, die durch die bisher erforderliche Netzwerksegmentierung nicht möglich waren. Neben den Herstellern der Protokollstacks sind nachfolgend auch die Komponentenhersteller gefordert, eine sichere Implementierung in ihren Geräten umzusetzen. Die erforderlichen Maßnahmen gehen dabei über die Nutzung eines sicheren Protokollstacks hinaus. Der Beitrag zeigt am Beispiel eines Ethernet-APL Messumformers mit PROFINET-Kommunikation die künftig von PROFINET-Geräteherstellern zu berücksichtigenden technischen und organisatorischen Rahmenbedingungen.
The PROFINET protocol has been extended in the current version to include security functions. This allows flexible network architectures with the consideration of OT security requirements to be designed for PROFINET, which were not possible due to the network segmentation previously required. In addition to the manufacturers of the protocol stacks, component manufacturers are also required to provide a secure implementation in their devices. The necessary measures go beyond the use of a secure protocol stack. Using the example of an Ethernet-APL transmitter with PROFINET communication, this article shows which technical and organizational conditions will have to be considered by PROFINET device manufacturers in the future.
PROFINET Security: A Look on Selected Concepts for Secure Communication in the Automation Domain
(2023)
We provide a brief overview of the cryptographic security extensions for PROFINET, as defined and specified by PROFIBUS & PROFINET International (PI). These come in three hierarchically defined Security Classes, called Security Class 1, 2 and 3. Security Class 1 provides basic security improvements with moderate implementation impact on PROFINET components. Security Classes 2 and 3, in contrast, introduce an integrated cryptographic protection of PROFINET communication. We first highlight and discuss the security features that the PROFINET specification offers for future PROFINET products. Then, as our main focus, we take a closer look at some of the technical challenges that were faced during the conceptualization and design of Security Class 2 and 3 features. In particular, we elaborate on how secure application relations between PROFINET components are established and how a disruption-free availability of a secure communication channel is guaranteed despite the need to refresh cryptographic keys regularly. The authors are members of the PI Working Group CB/PG10 Security.
