Security

The increasing interconnection of IT and OT systems within and beyond the boundaries of production sites is increasing the need for security in production systems. Security therefore plays a vital role in industrial communication systems and has become a key consideration in the development of automation components. For efficiency reasons, a security concept must be standardized and span across all levels of a manufacturing company, from IT to OT.

To meet the rapidly growing security requirements, PI has initiated security-related activities in several working groups. Security-relevant extensions have already been added to the PROFINET specification. PI's security experts are working closely with TÜV Süd to ensure conformity with the IEC 62443-4-2 security standard.

While security is primarily important for Ethernet-based communication, other non-Ethernet-based communication technologies, such as IO-Link and PROFIBUS, must also be considered as they can be subject to security threats.

PI Technologies - Security Activities Overview

PROFINET

Security

PI Working Group CB/PG 10: PROFINET Security

Purpose: CB/PG10 Security specifies security mechanisms for PROFINET and provides guidance, documentation, and best practices for PROFINET Security.
Resources: PROFINET Specification including Security Functions, implementation and usage guidelines, test bundles for testing and verifying PROFINET security, whitepapers
Target group: Technology providers, device manufacturers and machine builders that develop and produce PROFINET components and systems.
Activities: Advancing protocol and security configuration management (e.g. migrating to modern TLS versions); enhancing secure communication across all layers, including vertical integration; preparing for post-quantum cryptography and long-term cryptographic agility; improving update and lifecycle security for devices and software; defining secure models for device onboarding.
Planned: Whitepaper PROFINET Security for end user

Interop Testfield
AdHoc WG: PROFINET Security Interop Field Test for Ethernet APL and PROFINET

Purpose: Coordinating an interoperability field test for PROFINET Security for PROFINET field devices, switches, controllers and DCS providers with PN Security capability in process automation, with a focus on Ethernet APL devices.
Resources: Presentation "Security and PROFIsafe for PROFINET over APL"
Target group: Users, technology manufacturers and device and system manufacturers specialising in process automation.
Activities: Investigate the functionality and usability of workflows and use cases for a PROFINET security application such as credentialing, secure onboarding, communication setup, device replacement, firmware update, identity and access management.
Planned: Publication of test results and findings on the integration of PROFINET devices into control systems by the end of 2026.

Device/Tool Security

JWG: Device and Tool security for Ethernet-based communication protocols
Standardization organizations FieldComm Group, ODVA, OPC Foundation, and PROFIBUS & PROFINET International have formed a Joint Working Group (JWG) to collaborate on the important issue of "Device/Tool Security for Ethernet-Based Communication Protocols."

Purpose: Uniform interpretation and implementation of security in Ethernet-based protocols.
Resources: Call for Experts
Target group: Users, technology manufacturers, and device manufacturers.
Planned: Develop a framework that allows suppliers and end users to meet industry requirements in accordance with the IEC 62443 and IEC 61784-6 (Part 6: Security) standards. Recommend updates as necessary.

Additional Ressources:

Security Extensions for PROFINET Whitepaper

First, this document describes the motivation and the procedure for developing a security concept. Next, it determines the security requirements and the actors in the security process. Then the basic principles of PROFINET security are explained.

PROFINET Security Guideline

The Security guideline points out the key aspects for the establishment of a security concept in an industrial environment and provides appropriate recommendations. This guideline (Order. No. 7.001, 7002) dates November 2013. It will be replaced by an updated guideline that considers the PROFINET security concept as well as the requirements of the IEC 62443.

PROFINET Security Class 1 Guideline

This document is intended to provide an overview of the planed methods, applications and processes of the PROFINET Security extension in Security Class 1. It addresses component manufacturers, system vendors, and users of PROFINET technology.

Read more

PI White Paper: OT-Security - Classification of IEC62443

This white paper first provides an overview of the various parts of the IEC 62443 series of standards and briefly describing their contents. Next, it assigns the standard parts to the stakeholders in the OT security process. In the field of Operational Technology (OT) these include plant operators, system integrators and the product suppliers. Building on these front-up considerations, the document maps the security concept of PROFINET to the different parts of the IEC 62443.
Read more

IT security extensions for PROFINET

Karl-Heinz Niemann
This paper was presented at the IEEE 17th International Conference on Industrial Informatics (INDIN) in 2019. It gives an overview of the concepts of PROFINET security.
Read more

Security extensions for PROFINET - Concepts, Status and Prospects

Karl-Heinz Niemann, Andreas Walz, Axel Sikora
This paper was presented at the Embedded World 2023 Exhibition & Conference 2023. It describes the technological concepts of PROFINET security.

A Mechanism for Seamless Cryptographic Rekeying in Real-Time Communication Systems

Heiko Bühler, Andreas Walz, Axel Sikora
The paper was presented at 17th IEEE International Conference on Factory Communication Systems (WFCS) in 2021. The document presents a novel seamless rekeying approach, which can be embedded into cyclic application data exchanges. Although, being agnostic to the underlying real-time communication system, the developed demonstrator can emulate the widespread industrial Ethernet system PROFINET IO and successfully use this rekeying mechanism.

PROFINET Security: A Look on Selected Concepts for Secure Communication in the Automation Domain

Andreas Walz, Karl-Heinz Niemann, Julian Göppert, Kai Fischer, Simon Merklin, Dominik Ziegler, Axel Sikora
The paper was published at the IEEE 21st International Conference on Industrial Informatics (INDIN) in 2023. It provides a brief overview of the cryptographic security extensions for PROFINET, as defined and specified by PROFIBUS & PROFINET International (PI)

How to develop a secure PROFINET device: Organizational and technical OT security measures during the development of PROFINET devices

Karl-Heinz Niemann, Andreas Walz, Simon Merklin, Andreas Ziegler, Boris Waldeck
This article was originally published in the atp magazine 09/2023. The article shows which technical and organizational measures have to be considered during the development of a PROFINET device supporting PROFINET security. An Ethernet APL transmitter serves as an example. Based on that analysis, requirements for the secure design of Ethernet APL communication combined with PROFINET are derived from.

OT Security Requirements for Ethernet-APL field devices
Karl-Heinz Niemann, Simon Merklin
This paper was published in the atp magazine 05/2022. It describes cyber security attack scenarios for automation systems using current loop with HART, PROFIBUS PA and Ethernet APL in combination with PROFINET.

Cryptographic Protection of Cyclic Real-Time Communication in Ethernet-Based Fieldbuses: How Much Hardware is Required?

Matthias Skuballa, Andreas Walz, Heiko Bühler, Axel Sikora
This paper was presented at 26th IEEE International Conference on Emerging Technologies and Factory Automation (ETFA ) in 2021. It evaluates the performance of or the EAS-GCM Algorithm that is used for PROFINET security.

IO-Link

Secure Deployment

IO-Link Secure Deployment Guideline

Purpose: To help end users judging and implementing security measures for IO-Link usage. The main objective is to equip them with the knowledge and tools necessary for effectively assessing and implementing safety measures for IO-Link technology.
Resources: IO-Link Secure Deployment Guideline
Target group: Technology manufacturers, device manufacturers, and users
Activities: Currently no activities other than participation in Joint WG Security.

Secure Design and Development

IO-Link Secure Design and Development Guideline (in progress)

Purpose: To help designers and implementers of IO-Link products interpreting the security standards.
Resources: Development guideline is in progress.
Target group: Technology manufacturers, device manufacturers
Activities: Completion of the editorial work on the development guideline, participation in Joint WG Security.

Non-Ethernet-Protocols

Device/Tool Security

JWG: “Device / tool security for non-Ethernet-based protocols”

Purpose: Uniform interpretation and implementation of security in our digital interfaces, including tools for Ethernet-based protocols.
Resources: Call For Experts
Target group: Technology manufacturers, device manufacturers, and users
Activities: High level threat risk assessments for process automation plants for respective digital interfaces.

omlox

omlox Hub

omlox Hub Spec with Security Recommendations (chapter 17)

Purpose: The omlox hub API ensures secure and controlled access to mission-critical location data through a robust combination of OAuth-based authentication e.g. via OpenID, fine-grained authorization, and role-based access control (RBAC). By verifying the identity of users and applications via industry-standard OAuth protocols and enforcing role-specific permissions, the system guarantees that only authorized entities can access or modify sensitive location information. This layered security model not only protects against unauthorized access and misuse but also provides a future-proof foundation also considering the EU Cyber Resilience Act (CRA), and offering the ideal toolset to meet stringent requirements for secure-by-design connected systems in industrial environments.
Resources: omlox Hub Spec with Security Recommendations (chapter 17)
Target Group: End users
Activities: Adaptation of PI Security to the omlox-core zone for secure ultra-wideband communication and positioning. (planned)

NOA

Security

JWG "NOA Security-Validation“ (planned)

Purpose: The JWG will collect specifications developed in other security WG’s and validate these specifications against NOA-use cases.
Resources: NE 175: NAMUR Open Architecture – NOA Concept; NE 177 – NOA Security Zones and Security Gateway
Target group: Technology manufacturers, device manufacturers, and users
Activities: A kickoff meeting will be held for the JWG leaders of the new NOA Committee. Afterwards, a call for experts will be issued.