Control system for technical installations and method for transmitting certification requests for installation components - Patents.com

Abstract

A control system for a technical installation, in particular a process or production installation, is proposed, which has a computer-implemented registration service (3) that is adapted to: receive a certificate request (2) from an equipment component (1) of the technical installation, the certificate request comprising information on the identity of the equipment component (1); retrieve from a first memory (6) information on which certificates have already been assigned, can be assigned and are to be assigned to the equipment component (1); determine based on the information on the identity of the equipment component (1) and on the certificates that can be assigned and the certificates that are to be assigned what type the certificate request (2) has and which registration authority (4) or certification authority (5a, 5b) of the technical installation is responsible for the certificate request (2); and transmit the certificate request (2) of the equipment component (1) together with information on the type of the certificate request (2) to the responsible registration authority (4) or certification authority (5a, 5b).

Description

[Technical Field]

[0001] The present invention relates to a control system for a technical installation, in particular a process or manufacturing installation. Furthermore, the present invention relates to a method for transmitting a certificate request from an installation component of a technical installation, in particular a process or manufacturing installation. Furthermore, the present invention relates to the use of a control system for operating a technical installation.

[0002] Based on the growing need and demand for protection of IEC 62443 as the leading industrial security standard (due to the increasing use of open IT standards and protocols), there is an increasing need to protect communication connections in the control systems of technical installations, i.e. they must be adequately protected against unauthorized access.

[0003] The appropriate protection may include, in particular, encryption and / or authentication of the transmitted data, depending on the results of a so-called threat and risk analysis (TRA). The corresponding encryption and authentication mechanisms are usually components of secure communication protocols (e.g., TLS, OPC UA, etc.). The use of secure communication protocols presupposes that the communication participants have digital certificates.

[0004] Certificates used in operational environments (e.g., industrial installations) to enable, for example, secure communication or user authentication are usually referred to as "Operational Certificates" (OC). For security reasons, it is recommended to use dedicated operational certificates for each communication protocol used. This means that if installation components use, for example, OPC UA to secure one communication relationship and TLS to secure another, these components each require one OPC UA certificate and one TLS certificate (for TLS server or TLS client authentication). If the number of installation components, and therefore the number of required operational certificates, is small, the certificates can be imported manually into the installation components.

[0005] As the number of equipment components that are involved in secure communication relationships and require various certificates increases, it becomes reasonable to automate the issuance of operational certificates based on Certificate Requests (CRs) generated by equipment components and the assignment of issued certificates to components. Such automated certificate management usually presupposes a so-called Public Key Infrastructure (PKI), which should be present in each operating environment (e.g., in industrial installations).

[0006] The known flow for requesting and issuing operational certificates can be described as follows: equipment components submit their certificate requests (Certificate Requests or Certificate Signing Requests (CSR) in English) to a so-called Registration Authority (RA for short), which validates these requests (by consulting its memory or inventory to check whether each component can obtain a certificate), then signs these certificate requests with its own private key and forwards them to the responsible Certification Authority (CA for short), also called "Issuing CA".

[0007] The certification authority uses the registration authority's public key, which it possesses, to verify the signature in the certificate request, after which it issues a certificate and transmits it to the registration authority, which then verifies the validity of the certificate and forwards it to the component requester.

[0008] To enable equipment components to optimally "talk" to the components of the public key infrastructure they use, these components increasingly implement certificate management protocols, such as the Certificate Management Protocol (CMP) according to RFC 4210 or the Lightweight CMP Profile. Such protocols allow different scenarios to be distinguished (e.g., the initial request for an operational certificate for a specific purpose or the request for renewal of an already existing operational certificate for a specific purpose). Furthermore, such protocols are suitable for requesting different types of certificates. Before requesting an application-specific operational certificate, it is often recommended to provide equipment components with customer certificates (CDCs) that are bound to the equipment and then use these as the basis for requesting an operational certificate. The customer certificate binds the component to the customer equipment (just as an employee certificate binds an employee to a company).

[0009] For example, when using the CMP protocol and the associated CRMF format, CDC requests are made using the CMP message type "Initial Request." For subsequent requests for required operational certificates, the CMP message type "Certificate Request" is used, while CDC or OC updates are made using the CMP message type "Key Update Request" (KUR), where each request is signed with the certificate to be updated (or more precisely, with the associated private key) and also contains the certificate's ID (e.g., serial number) and, if necessary, the name of the certification authority to be addressed (as the value of the parameter "Recipient"). All the scenarios described above can therefore be fully automated without any user interaction.

[0010] Based on the implementation of intelligent certificate management protocols, installation components must become more intelligent and be able to decide for themselves, for example, whether an operational certificate (or, more precisely, the corresponding key pair) should now be renewed (because the operational certificate is about to expire) or whether the operational certificate should be revoked for specific reasons. In today's industrial installations, which are usually heterogeneous with regard to the mechanisms used for certificate management, the majority of industrial terminal devices support only very simple certificate mechanisms (if any) and can only generate certificate requests for key pairs (self-generated or generated on behalf of another authority) in the so-called PKCS#10 format according to RFC2986 themselves, or which are (on behalf of) generated by a user (for example using OpenSSL).

[0011] Such a certificate request, signed by a private key (Private Key) together with the corresponding public key (Public Key), can be transmitted to a certification authority via any transport channel (e.g., on a USB stick), for example in the form of a PEM file, which then issues a certificate based on this certificate request, which certificate contains, among other things, the information about the ordering party contained in the certificate request and their public key.

[0012] The certificate can likewise be delivered to the requester via various channels, and the requester then validates this certificate according to RFC5280, checking, among other things, whether the public key is correct (which gives rise to the so-called Proof of Possession) and whether certain certificate contents (in particular the so-called "Distinguished Name") match those requested.

[0013] For the reasons mentioned above, it is currently not possible (or possible to reproduce without user cooperation) to reproduce relatively complex scenarios (such as, for example, requests for CDC-based operational certificates or requests for CDC / OC updates) using "relatively simple" formats such as PKCS#10. However, user cooperation increases the probability of accidental or intentional errors, which can jeopardize the normal operation and availability of industrial facilities. Even if no errors occur, the risk of delays can increase significantly due to the manual intervention required.

[0014] Now, when a certificate request in the (prevalent) PKCS#10 format is created by the equipment component itself or by a user (on its behalf) and is not transmitted using an intelligent certificate management protocol (e.g. CMP) but rather via a relatively simple channel, e.g. a USB stick, such a request usually does not contain any indication whether it is an initial request or a renewal of a certificate (e.g. a CDC or operational certificate).

[0015] The possibly predetermined order in which particular certificates should be requested within a facility is not directly reproducible in such a certificate request. Therefore, such a certificate request can only be interpreted by a registration authority or certification authority as an initial certificate request. In particular, if multiple certification authorities are in place, a registration authority cannot determine, based on the contents of the certificate request, to which certification authority the certificate request is intended.

[0016] EP 3258662 A1 discloses a method for registering an intelligent electrical device with a certificate authority.

[0017] US Pat. No. 5,745,574 discloses a security infrastructure with multiple certificate authorities.

[0018] The problem on which the invention is based is to provide a control system for technical installations, which makes the certificate management for simple installation components of the technical installations significantly easier and more reliable.

[0019] The above-mentioned problem is solved by a registration authority for a control system of a technical installation, in particular a manufacturing or process installation, having the features of claim 1. Furthermore, the above-mentioned problem is solved by a method for transmitting a certificate request from an installation component of a technical installation, in particular a process or manufacturing installation, having the features of claim 9. Furthermore, the above-mentioned problem is solved by the use of a control system according to claim 17. Advantageous developments become apparent from the dependent claims.

[0020] The control system for technical installations according to the invention comprises a computer-implemented registration service, which registration service: receiving a certificate request from an equipment component of the technical equipment, the certificate request including information about the identity of the equipment component; retrieving from the first memory information about which certificates have already been assigned, can be assigned, or should be assigned to the equipment component; Identifying what type of certificate request it has and which registration authority or certification authority of the technical installation is responsible for the certificate request, based on information about the identity of the equipment components and information about the certificates that can be assigned and the certificates to be assigned; Transmitting the certificate request for the equipment component to the responsible registration authority or responsible certification authority, together with information about the type of certificate request; It is structured as follows.

[0021] The technical installations may be installations from the process industry, such as chemical, pharmaceutical or petrochemical installations, or from the food and luxury goods industry. This also includes any installations from the production industry, such as factories where automobiles or any type of goods are produced. The technical installations suitable for carrying out the method according to the invention may also come from the field of energy generation. Wind turbines, photovoltaic installations or power plants for energy generation are also included in the concept of technical installations.

[0022] A control system is understood in this context to be a computer-aided technical system that includes functions for representing, operating, and controlling technical manufacturing or production facilities. A control system may also include sensors for determining measured values ​​as well as various actuators. Furthermore, a control system may include so-called process- or production-related components that are used to control the activation of actuators or sensors. Furthermore, a control system may have, inter alia, means for visualizing and engineering the technical installation. The concept of a control system is also understood to include other computing units for more complex coordination and systems for data storage and processing.

[0023] A certificate is understood to be a digital data set that identifies a particular characteristic (in this case, a machine, a device, an application, etc.). The authenticity and integrity of a certificate can usually be verified by cryptographic methods.

[0024] A certificate request may be an initial request of an equipment component, i.e., a first attempt to obtain a certificate from a certification authority (e.g., to be able to communicate with other equipment components of a technical installation), but it may also be a request to renew an already previously issued certificate whose validity has expired or is about to expire.

[0025] The certificate request contains at least one piece of information about the identity of the requesting equipment component. The registration service uses this information to retrieve from memory information about which certificates have already been assigned to the equipment component, which certificates can be assigned, and which certificates should be assigned. By combining the information about the equipment component's identity with the information retrieved from memory, the registration service can determine what type of certificate request it has. In other words, this allows the registration service to know whether it is an initial certificate request or a certificate renewal. Furthermore, the registration service is configured to use this previously retrieved information to determine which registration authority (RA) or certification authority (CA) of the technical equipment is responsible for this certificate request.

[0026] The registration service then uses the information about the type of certificate request to adapt the certificate request of the equipment component and transmits the certificate request to the registration authority or certification authority responsible for the technical equipment. Thus, the certificate request or "raw data", present in a basic format (e.g., in PKCS#10 format), from which important information about the requester's identity can be extracted (e.g., the requester's name, the requester's ID, which may be in the form of, for example, a serial number or a product instance URI), can be appropriately transformed by the control system's registration service and forwarded to the correct recipient.

[0027] Furthermore, the control system of the facility components according to the invention allows them to use a registration service to address their certificate requests directly to the certification authority responsible for them (without the need for time-consuming manual intervention by the technical facility administrator).

[0028] A registration service may be computer-implemented on a component of a public key infrastructure such as a local registration authority. However, a registration service may also be computer-implemented on an end device of a technical installation, in particular on a network component such as a switch or firewall component. The concept of "public key infrastructure" (abbreviated PKI) relates to a security infrastructure for a technical installation that provides services for the secure exchange of data between communication partners of the technical installation. Using a public key infrastructure, certificates can be issued, distributed and verified.

[0029] In an advantageous development of the invention, the registration service has trust relationships with the installation components and with one or more registration authorities and / or certification authorities of the technical installation, which trust relationships are preferably certificate-based, so that the registration service can reliably and efficiently perform the above-mentioned conversion and forwarding operations.

[0030] Preferably, the registration service is configured to retrieve from the first or second memory information about which registration authority or certification authority of the technical facility is responsible for the certificate request. The information about the responsibility can be retrieved from the same (first) memory, which, as mentioned above, also contains information about which certificates are assigned, can be assigned, or should be assigned to the facility components. However, the information about the responsibility can also be stored in a second memory. Both the first and second memories can be (physically) located within the technical facility. However, it is also possible to realize the first and / or second memory in a cloud-based environment (physically outside the technical facility).

[0031] The first memory and / or the second memory may particularly preferably be implemented on a component of a public key infrastructure, in particular a registration authority, on an engineering station server or an operator station server of a control system, or on a terminal device of a technical installation, in particular a network component or an automation device.

[0032] By "engineering station server" is meant here a server that is configured to create, manage, record, and document various hardware and software projects related to the control systems of technical installations. Using special software design tools (engineering tool sets) and pre-manufactured modules and plans, the interaction of the control technology devices and equipment of technical installations can be planned and managed by the engineering station server. An example of this is the SIMATIC Manager Server from the company SIEMENS.

[0033] An "operator station server" is understood here to mean a server that centrally detects and provides users with data from operating and monitoring systems, as well as, typically, alarm and measured value archives from the control system of a technical installation. An operator station server typically establishes a communication connection to the automation system of the technical installation and transfers the data of the technical installation to so-called clients, which use this data to operate and monitor the operation of the individual functional elements of the technical installation. An operator station server may have client functionality in order to access data (archives, messages, tags, variables) of other operator station servers.

[0034] This allows the picture of the operation of the technical installation at an operator station server to be combined with variables from other operator station servers (inter-server communication), which can be, but is not limited to, a SIMATIC PCS 7 Industrial Workstation Server from SIEMENS.

[0035] The automation equipment is used to realize automation and may be, for example, a programmable logic controller that is a higher-level control function for a lower-level programmable logic controller.

[0036] Furthermore, the above-mentioned problem is solved by a method for transmitting a certificate request from an installation component of a technical installation, in particular a process installation or a manufacturing installation, having a computer-implemented registration service to a registration or certification authority of the technical installation, the method comprising: receiving, by the registration authority, from an equipment component of the technical equipment, a certificate request containing information about the identity of the equipment component; retrieving, by the registration authority, from the first memory, information regarding which certificates can and should be assigned to the equipment component; by the registration authority, based on information about the identity of the equipment components and information about the certificates already assigned, available for assignment and to be assigned, to identify what type of certificate request it is and which registration authority or certification authority of the technical equipment is responsible for the certificate request; · Transmitting by the registration authority the certificate request for the equipment component, together with information on the type of certificate request, to the responsible registration authority or responsible certification authority. Contains:

[0037] The above-mentioned object is furthermore achieved by the use of a control system for the operation of a technical installation, in particular a manufacturing or process installation, as described above.

[0038] The above-mentioned characteristics, features and advantages of the present invention, as well as how they are accomplished, will become more apparent and clearly understood in connection with the following detailed description of the embodiments set forth in conjunction with the drawings. [Brief explanation of the drawings]

[0039] [Figure 1] FIG. 1 shows a schematic diagram of a method according to the invention.

[0040] The figure shows a schematic representation of the method according to the invention. In a first step (I), an equipment component 1 presents a certificate request 2 in PKCS#10 format. A registration service 3 of the technical equipment control system receives the certificate request 2 of the equipment component 1. The registration service 3 has a certificate-based trust relationship with one registration authority 4 and two certification authorities 5a, 5b of the technical equipment.

[0041] The registration service 3 retrieves information about the identity of the equipment component 1 from the certificate request 2. The registration service 3 then accesses a configuration memory 6 implemented in the technical equipment and retrieves information about which certificates have already been assigned, can be assigned, or should be assigned to the equipment component 1. The registration service 3 then retrieves information from the configuration memory 6 about which registration authority 4 or certification authority 5a, 5b of the technical equipment is responsible for the certificate request 2. In this case, the configuration memory 6 is implemented in an engineering station server of the control system. Different certification authorities 5a, 5b may be responsible for different types of certificates.

[0042] The registration service 3 then uses the information retrieved from the configuration memory 6 to convert the certificate request 2 from the basic PKCS#10 format into a more comprehensive format (e.g., CMP protocol) that includes the type of the certificate request 2 (step II). The criteria for converting the certificate request may be fixed, e.g., by a technical facility administrator, or adaptively set by a self-learning system.

[0043] In a subsequent step (III), the more comprehensive certificate request 2 is forwarded to the registration authority 4, which in a further step (IV) forwards the certificate request 2 to the certification authority 5a that is in charge in this case.

[0044] After the certificate request 2 has been verified and the requested certificate has been issued, in subsequent steps (V, VI, VII) the issued certificate is forwarded to the requesting equipment component 1 .

[0045] The above-mentioned technical features eliminate the need for user cooperation during the conversion of certificate requests, thereby eliminating the associated risks mentioned in the opening paragraph, and thus the invention can contribute to improved automation of certificate management of technical installations, uninterrupted normal operation and improved availability of heterogeneous technical installations.

[0046] Although the details of the present invention have been illustrated and described in detail by means of preferred embodiments, the present invention is not limited to these disclosed examples, and other variations can be derived therefrom by those skilled in the art without departing from the scope of protection of the present invention.

Claims

1. 1. A control system for a process facility, comprising: the process facility is a chemical, pharmaceutical, or petrochemical facility or a facility in the food and beverage industry; the control system includes functionality for representing, operating, and controlling the process equipment; The control system comprises a computer-implemented registration service (3), the registration service (3) comprising: receiving a certificate request (2) from an equipment component (1) of the process equipment, the certificate request (2) including information regarding the identity of the equipment component (1); retrieving from a first memory (6) information about which certificates have already been assigned, can be assigned or should be assigned to said equipment component (1); determining what type the certificate request (2) has and which registration authority (4) or certification authority (5a, 5b) of the process facility is responsible for the certificate request (2) based on combining the information about the identity of the facility component (1) with the information about the certificates available for assignment and the certificates to be assigned retrieved from the first memory (6), said type being an initial certificate request or a request for certificate renewal; transmitting the certificate request (2) of the equipment component (1) together with information about the type of the certificate request (2) to the responsible registration authority (4) or the responsible certification authority (5a, 5b); It is configured as follows: Control system.

2. 2. The control system of claim 1, wherein the registration service (3) is computer-implemented on a component of the process facility's public key infrastructure.

3. 2. The control system of claim 1, wherein the registration service (3) is computer-implemented on a terminal device of the process facility.

4. 2. The control system according to claim 1, wherein the registration service (3) is configured to retrieve from the first memory (6) or the second memory information about which registration authority (4) or which certification authority (5a, 5b) of the process facility is responsible for the certificate request (2).

5. 5. The control system of claim 4, wherein the first memory (6) or the second memory is implemented on a component of a public key infrastructure.

6. 5. The control system according to claim 4, wherein the first memory (6) or the second memory is implemented on an engineering station server of the control system or an operator station server of the control system.

7. The control system according to claim 4 , wherein the first memory or the second memory is mounted on a terminal device of the process facility.

8. 1. A method for transmitting a certificate request from an equipment component (1) of a process equipment to a registration authority (4) or certification authority (5a, 5b) of said process equipment by a control system having a computer-implemented registration service (3), comprising: The method comprises: receiving, by said registration service (3), from an equipment component (1) of said process equipment, a certificate request (2) containing information regarding the identity of said equipment component (1); retrieving, by said registration service (3), from a first memory (6) information about which certificates can and should be assigned to said equipment component (1); determining by the registration service (3) what type the certificate request (2) has and which registration authority (4) or certification authority (5a, 5b) of the process facility is responsible for the certificate request (2) based on combining the information about the identity of the equipment component (1) with the information about the certificates already assigned, the certificates available for assignment and the certificates to be assigned retrieved from the first memory (6), wherein the type is an initial certificate request or a request for certificate renewal; transmitting by the registration service (3) the certificate request (2) of the equipment component (1) together with information about the type of the certificate request (2) to the responsible registration authority (4) or the responsible certification authority (5a, 5b); Contains, method.

9. 9. The method of claim 8, wherein the registration service (3) is computer implemented on a component of the process facility's public key infrastructure.

10. 10. The method according to claim 8 or 9, wherein the registration service (3) is computer-implemented on a terminal device of the process installation.

11. 10. The method according to claim 8 or 9, wherein the registration service (3) retrieves from the first memory (6) or the second memory information about which registration authority (4) or which certification authority (5a, 5b) of the process facility is responsible for the certificate request (2).

12. 10. The method according to claim 8 or 9, wherein the first memory (6) or the second memory is implemented on a component of a public key infrastructure.

13. 10. The method according to claim 8, wherein the first memory or the second memory is implemented on an engineering station server of the control system or an operator station server of the control system.

14. The method according to claim 8 or 9, wherein the first memory or the second memory is implemented on a terminal device of the process facility.

Images