Siemens SIMATIC ET 200AL, Системное руководство

Страница: 1162 / 2255

Communications services
3.6 Secure Communication
Communication
Function Manual, 05/2021, A5E03735815-AJ
41
Objectives of secure communication
Secure communication is used to achieve the following objectives:
•
Confidentiality
i.e. the data are secret / cannot by read by eavesdroppers.
• Integrity
i.e. the message that reaches the recipient is the same message, unchanged, that the
sender sent. The message has not been altered on the way.
• End point authentication
i.e. the end point communication partner is exactly who it claims to be and the party who
is to be reached. The identity of the partner has been checked.
These objectives were in the past primarily relevant to IT and networked computers. Now,
industrial machinery and control systems with sensitive data are at equally high risk, as they
are also networked, and consequently pose strict security requirements for data exchange.
Protection of the automation cell by means of the cell protection concept through firewall, or
via connection through VPN, for example with the security module, was common in the past
and remains so.
However, it is becoming increasingly necessary to also transfer data to external computers in
encrypted form via Intranet or public networks.
Common principles of secure communication
Independent of the context, secure communication is based on the concept of the Public Key
Infrastructure (PKI) and contains the following components:
•
An asymmetric encryption scheme that allows:
– Encryption or decryption of messages using public or private keys.
– The verification of signatures in messages and certificates.
The messages/certificates are signed by the sender/certificate subject with their private
key. The recipient/verifier checks the signature with the public key of the
sender/certificate subject.
• Transport and storage of the public key using X.509 certificates:
– X.509 certificates are digitally signed data that allow public key authentication in terms
of the bound identity.
– X.509 certificates can contain information that describes in more detail or restricts use
of the public key. For example the date as of which a public key in a certificate is valid
and when it expires.
– X.509 certificates contain information about the issuer of the certificate in secure form.
The following paragraphs give an overview of these basic concepts, which are required for
managing certificates in STEP 7 (TIA Portal), for example, and for programming
communication instructions for secure Open User Communication (sOUC).