PROFINET Security: A Look on Selected Concepts for Secure Communication in the Automation Domain

Abstract

We provide a brief overview of the cryptographic security extensions for PROFINET, as defined and specified by PROFIBUS & PROFINET International (PI). These come in three hierarchically defined Security Classes, called Security Class 1, 2 and 3. Security Class 1 provides basic security improvements with moderate implementation impact on PROFINET components. Security Classes 2 and 3, in contrast, introduce an integrated cryptographic protection of PROFINET communication. We first highlight and discuss the security features that the PROFINET specification offers for future PROFINET products. Then, as our main focus, we take a closer look at some of the technical challenges that were faced during the conceptualization and design of Security Class 2 and 3 features. In particular, we elaborate on how secure application relations between PROFINET components are established and how a disruption-free availability of a secure communication channel is guaranteed despite the need to refresh cryptographic keys regularly. The authors are members of the PI Working Group CB/PG10 Security.

A Survey on Life-Cycle-Oriented Certificate Management in Industrial Networking Environments

“…The use of symmetric cryptography requires the involved endpoints to hold a shared symmetric key for message protection. To proceed, a certificatebased mutually authenticated key agreement, certificates, private keys, and trust anchors are required in the IA components [10]. In order to have certificates, private keys, and trust anchors in IA components, the secure management of these artifacts is required throughout the whole life cycle of an IA component [11].…”