Siemens SIMATIC ET 200AL, System Manual

Page: 1185 / 2255

Communications services
3.6 Secure Communication
Communication
64
Function Manual, 05/2021, A5E03735815-AJ
"Protection of confidential configuration data" principle
The following figure shows in a simplified way how confidential configuration data, for
example of a standard S7-1500 CPU, is protected: The two components project and key
information are placed in different memory areas when loaded for the first time. The project
in the load memory (memory card), the key information in a memory area in the CPU.
For other target systems (e.g. S7-1200 CPU, software controller) with different storage
concepts, the implementation is adapted to the corresponding storage concepts, but the
principle is the same.
① Project with password-protected confidential configuration data (here: in load memory =
memory card)
② Key information (generated from password) to use the protected confidential configuration
data (here: in the memory area in the CPU)
Figure 3-16 Principle for protection of confidential configuration data
Two memory areas for more security
The charged components are related to each other like two matching puzzle pieces: The
project is bound to the loaded key information, the loaded key information is bound to the
password that was assigned during configuration.
Project and key information must match, otherwise the CPU will not start.
The principle of two separate memory areas also applies to the S7-1200 CPUs and S7-1500
CPU versions without a memory card, e.g. for the SW controller or PLCSim/ PLCSim Advanced.
In the versions without memory card, two separate partitions are used so that the two items
of information can be managed independently of one another.
Figure 3-17 Principle of two separate memory areas