Certificate management in a technical installation

Abstract

The invention relates to a control system (1) for a technical installation, in particular a manufacturing or process installation, comprising a certification authority (3) which is responsible and designed for issuing and revoking certificates for installation components (5) of the technical installation. A certificate service (4) is implemented in the control system (1), which certificate service is connected to the certification authority (3) directly or indirectly via a registration authority (2) which is designed exclusively according to the HTTPS protocol, wherein the certificate service (4) is designed to be used by an installation component (5) of the technical installation, to receive a request for integration of the installation component (5) into a communication network of the technical installation exclusively on the basis of the HTTPS protocol and to integrate the installation component (5) into the communication network of the technical installation with the aid of a certificate management protocol supported by the installation component (5) and with inclusion of the registration authority (2) and / or the certification authority (3).

Description

[0001] Description

[0002] Certificate management in a technical facility

[0003] The invention relates to a control system for a technical plant, in particular a manufacturing or processing plant, comprising at least one certification authority that is responsible for and designed to issue and revoke certificates for plant components of the technical plant. Furthermore, the invention relates to a computer-implemented certificate service for a control system of a technical plant, in particular a processing or manufacturing plant. Furthermore, the invention relates to a method for the secure integration of a plant component into a communication network of a technical plant, in particular a processing or manufacturing plant.

[0004] So-called "Secure Device Onboarding" procedures (see, for example, BRSKI at https: / / datatracker.ietf.org / doc / rfc8995 / , FDO at https: / / fidoalliance.org / specs / FDO / FIDO-Device-Onboard-RD-v1.0-20201202.html) are increasingly being implemented in technical systems. These procedures are consistent with the fundamental principle of Zero Trust: "Never trust - always verify."

[0005] On the one hand, the corresponding procedures enable so-called proof of identity and / or proof of originality (see, for example, the requirement of IEC 62443 "Provisioning product supplier roots of trust"). On the other hand, they enable the secure provisioning of environment-specific credentials (e.g., the environment-specific certificates required for authentication with the associated cryptographic keys) to the system components of the technical system.

[0006] So-called Secure Zero Touch Device Onboarding procedures have proven particularly desirable because they enable identity and authenticity verification as well as the provisioning of environment-specific credentials fully automated, i.e., without any user assistance. This makes them particularly user-friendly. Even the automatic discovery of the entity (usually referred to as the registrar) against which the identity / authenticity verification is performed in the network and the provisioning of the aforementioned data to the device are fully automated within the Secure Zero Touch Onboarding procedures. Automatic discovery mechanisms such as DNS / DHCP, mDNS, or GRASP are used.Furthermore, it should be noted that in some deployment environments in a technical plant, such as a process plant or a manufacturing plant, not only the plant components connected to the respective network should be provisioned with device-specific LDevID generic certificates as part of the secure device onboarding or immediately thereafter. Rather, the applications hosted on the plant components, for example in the so-called Docker containers, should also receive the required application-specific LDevID app certificates. This is referred to as enrollment of the application-specific certificates. This process is also summarized as bootstrapping. Although this step is not a mandatory component of the known specifications such as the aforementioned BRSKI specification, it proves useful in many familiar scenarios.

[0007] Most secure device onboarding procedures, such as OPC UA Part 21 and BRSKI, require the presence of a dedicated secure device onboarding infrastructure. For example, when using BRSKI, a BRSKI registrar should be available in the deployment environment. Additionally, the manufacturer should provide a BRSKI MASA online. Using the secure device onboarding procedure according to OPC UA Part 21 requires the presence of an OPC UA Part 21 registrar in the deployment environment and the provision of a ticket server according to OPC UA Part 21.

[0008] Public Key Infrastructure (PKI) is increasingly being used in industrial environments to enable the automated management of X.509 certificates. A registration authority (e.g., the SIN EC Registration Authority from Siemens) is used as a gateway between the plant components or applications and an existing certification authority, usually operated within the plant operator's IT network.

[0009] Together, the aforementioned "Registration Authority (RA)" and the "Certification Authority (CA)" form a so-called Public Key Infrastructure (PKI). Through the use of special libraries (such as the so-called generic CMP client), system components are increasingly being enabled to automatically obtain the X.509 certificates they require, for example, for secure OPC UA / HTTPS communication from such a PKI.

[0010] The trustworthiness of the issuing CA itself can be ensured by having its own certificate signed by a trusted intermediate CA, whose certificate is in turn signed by another intermediate CA. The entire chain typically leads to a self-signed root CA (i.e., one that has signed its own certificate). The root CA is stored in a provably secure manner—according to the certificate policies listed in RFC 3647. The root CA can also be referred to as a trust anchor.

[0011] A registration authority (RA), as another central component of an automation system's public key infrastructure, is specifically tasked with receiving certificate signing requests (CSRs) from various system components. The registration authority can validate the certificate requests in consultation with a so-called RA inventory, also known as a device inventory, whose contents can originate, for example, from a configuration description of a technical system. Such a registration authority is disclosed, for example, in document EP 3 402 152 A1.

[0012] In contrast to a PKI, a Secure Device Onboarding infrastructure (e.g., according to BRSKI-AE and ANIMA-BRSKI) is very rarely found in industrial environments. For users, this means that onboarding, including identity and authenticity verification of the system components and the subsequent bootstrapping of the environment-specific certificates, especially the certificate of the so-called "Root Certification Authority," which acts as the so-called trust anchor or root of trust, must be performed manually. This process is often associated with considerable effort, given the often large number of system components, and requires extensive training for the system personnel.

[0013] Furthermore, no open source libraries are currently known to support automated secure device onboarding that could be used on various OT / IoT devices. Only a prototype implementation of a so-called BRSKI pledge exists. In contrast, the Generic CMP Client, for example, is available as an open source library and is also integrated into OpenSSL; see https: / / github.com / siemens / gencmpclient.

[0014] EP 3 993 339 B1 discloses a component as a PKI proxy, which is used at the network segment boundary of a segmented network to forward certificate signing requests (CSRs) from system components or applications that cannot reach the (central) registration authority via the network to the registration authority (e.g., the SIN EC Registration Authority). The invention is based on the object of specifying a control system for a technical system that contributes to increasing the availability of the technical system while simultaneously increasing security against manipulation and improving user-friendliness.

[0015] This object is achieved by a control system for a technical plant, in particular a manufacturing or process plant, which comprises at least one certification authority which is responsible and trained for issuing and revoking certificates for plant components of the technical plant, with the features of claim 1. In addition, the object is achieved by a computer-implemented certificate service for a control system of a technical plant, in particular a process or manufacturing plant, according to claim 10. In addition, the object is achieved by a method for the secure integration of a plant component into a communication network of a technical plant according to claim 11. Advantageous further developments arise from the dependent claims.

[0016] A control system of the type described above is characterized in that a certificate service is implemented in the control system, which is connected to the certification authority directly or indirectly via a registration authority, which is configured exclusively according to the HTTPS protocol. The certificate service is configured to receive a request from a system component of the technical system for integration into a communication network of the technical system based on the HTTPS protocol. The system component can preferably use a certificate representing its identity, such as a so-called Initial Device Identifier (IDevlD) certificate or a Locally Significant Device Identifier (LDevlD) certificate according to IEEE 802.1 AR, as a TLS client certificate for signing the HTTPS packet.

[0017] Furthermore, the certificate service is designed to securely integrate the system component into the technical system's communication network using a certificate management protocol supported by the system component and involving the registration authority and / or the certification authority. The system component can receive both an environment-specific certificate and the certificate from the root certification authority exclusively using a certificate management protocol (and in particular, without the aid of a special BRSKI voucher).

[0018] In this context, a control system is understood to be a computer-aided technical system that includes functionalities for displaying, operating, and managing a technical system such as a manufacturing or production facility. The control system can include process- or production-related components that serve to control actuators or sensors.

[0019] The technical plant can be a plant from the process industry, such as a chemical, pharmaceutical, petrochemical, or food and beverages industry. This also includes any plant from the manufacturing industry, such as factories where cars or goods of all kinds are produced. Technical plants suitable for carrying out the method according to the invention can also come from the field of energy generation. Wind turbines, solar systems, or power plants for energy generation are also encompassed by the term "technical plant."

[0020] A plant component can be individual measuring transducers for sensors or control units for actuators of the technical system. However, a plant component can also be a combination of several such measuring transducers or control units, for example, a motor, a reactor, a pump, or a valve system. Higher-level devices such as an automation device, an engineering station server, an operator station server, or a decentralized peripheral are also included under the term "plant component."

[0021] An automation device is a technical device used to implement automation. For example, it could be a programmable logic controller (PLC), which provides a higher-level control function for lower-level controllers.

[0022] An "operator station server" is defined here as a server that centrally records data from an operating and monitoring system, as well as, typically, alarm and measured value archives from a control system of a technical plant, and makes them available to users. The operator station server typically establishes a communication connection to automation systems (such as an automation device) of the technical plant and forwards data from the technical plant to so-called clients, which are used to operate and monitor the operation of the individual functional elements of the technical plant.

[0023] The operator station server can have client functions to access the data (archives, messages, tags, variables) of other operator station servers. This allows images of the operation of a technical plant on the operator station server to be combined with variables from other operator station servers (server-to-server communication). The operator station server can be, but is not limited to, a SIMATIC PCS 7 Industrial Workstation Server from SIEMENS.

[0024] A certificate is a digital data record that confirms certain properties (in this case, of machines, devices, applications, and the like). The authenticity and integrity of the certificate can usually be verified using cryptographic methods.

[0025] The certification authority is also referred to as an "Issuing CA (Certification Authority)." Such an Issuing CA is usually always online and, based on incoming certificate requests, issues certificates for various applicants, which it then signs with its own Issuing CA certificate. The trustworthiness of the Issuing CA is ensured by the fact that its own Issuing CA certificate is signed by the certificate of a trusted Root Certification Authority (also known as the "Root CA") located in a secure environment. It should be noted that the Root CA is offline most of the time and is only activated or enabled - under strict security precautions - when it is required to issue a certificate for an associated Issuing CA. The Root CA may be located outside the technical facility.The certification authority and / or registration authority can be implemented in a trust center and / or in a cloud-based environment. However, it is also possible for the certification authority and / or registration authority to be located within the technical facility ("on-premises").

[0026] A registration authority of a technical system is understood to be a functional entity that receives registration requests, such as certificate applications, from components of the technical system, verifies them, and, if successful, forwards them to a certification authority of the technical system. In this case, the registration authority is primarily intended to process certificate applications from system components of the technical system. The registration authority can be a local registration authority that can communicate with a higher-level global registration authority, which in turn can, for example, be directly connected to a certification authority of the technical system. The registration authority can include a registration service or be provided by one.

[0027] The HTTPS protocol stands for "Hypertext Transfer Protocol Secure" as of the filing date of this patent application and represents a secure version of the HTTP protocol used for data transmission in communication networks. HTTPS uses a combination of the HTTP protocol and the SSL / TLS (Secure Sockets Layer / Transport Layer Security) protocol to ensure the confidentiality and integrity of the transmitted data. The communication network of the technical system enables communication between individual components of the technical system and is used for the exchange of data, information, or commands.

[0028] The certificate management protocol provides a standardized interface or set of rules and procedures for performing various certificate-related tasks. It enables the exchange of information between certificate authorities, certificate requesters, certificate holders, and other entities in a PKI system. The certificate management protocol can, for example, be the CMP (Certification Management Protocol) protocol according to RFC4210.

[0029] The certificate service itself "speaks" exclusively the HTTPS protocol, meaning it can transport or transmit certificate signing requests securely (i.e., with authenticity protection and encryption) without being able to "understand" these requests in detail (i.e., parse, validate, and interpret them). It therefore also receives the integration request from the system component according to the HTTPS protocol, validates it, and forwards it to the registration authority or certification authority using the HTTPS protocol. The system component is then integrated using the certificate management protocol, for example, the CMP protocol using the HTTPS protocol ("CMP over HTTPS").

[0030] The control system according to the invention is advantageous in that it eliminates the need to provide a complex and extensive "Secure Device Onboarding" infrastructure. Rather, a conventional PKI infrastructure with a certification authority and an optional registration authority is sufficient to enable secure integration of the system component into the communication network of the technical system.

[0031] A particularly advantageous feature is that system components that cannot reach the registration authority or certification authority via communication technology can be forwarded to the departments responsible for integration in a particularly simple and efficient manner via the certificate service. The certificate service can be designed to be resource-efficient and low-effort by exclusively supporting and using the HTTPS protocol. The certificate service can be configured to compare the identification of the system component to be integrated into the control system with information from the control system, which information includes statements about which system components are intended for integration into the communication network of the technical system.For this purpose, the certificate service can have access to databases containing delivery notes, component lists, or similar items, which enable the certificate service to check whether the system component can even be expected in the technical system's communication network. The certificate service can notify an operator of the technical system of the result of the check so that they can respond if necessary. The notification can be provided via acoustic or visual signaling, in particular via a notification system implemented in the control system.

[0032] The certification service can be configured to refuse the integration of the system component into the technical system's communication network if the review reveals that the integration is not intended according to the information from the control system. This makes the integration of the system component into the communication network more secure, and unwanted system components cannot even contact the registration authority or certification authority.

[0033] Within the scope of an advantageous development of the invention, the certificate service is designed to check whether the request addressed to it by the system component for integration into the communication network of the technical system includes a certificate issued by a trusted certification authority and assigned to the system component as a TLS client certificate. This certificate assigned to the system component as a TLS client certificate can, for example, be a certificate issued by the manufacturer of the component (such as a so-called IDevID certificate according to IEEE 802.1AR or a comparable certificate equipped with adequate security measures) or a certificate issued by the OEM / machine manufacturer / integrator (such as a so-called LDevID certificate). The abbreviation “IDevID” stands for "Initial Device Identifier" according to the IEEE 802.1AR standard, while the abbreviation “LDevID” stands for "Locally Significant Device Identifier."In general, an IDevID certificate is understood to mean not only an IDevID certificate according to IEEE 802.1AR, but also another certificate issued by the manufacturer with adequate content, including adequate security mechanisms.

[0034] A TLS client certificate is a digital certificate issued by a trusted certification authority and used by a TLS client of the system component to prove its identity to the certificate service. If the IDevID certificate is used as the TLS client certificate of the system component, the identity of the TLS client corresponds to the identity of the system component. Unlike the server certificate, which is presented by the TLS server, the TLS client certificate is presented by the TLS client during the TLS handshake.

[0035] The TLS client certificate contains information about the system component, such as the name, identity, or public PKI key of the system component. The TLS client certificate can be digitally signed by the certification authority to ensure the authenticity and integrity of the TLS client certificate.

[0036] During the TLS handshake, the TLS client identifies itself to the certificate service using its TLS client certificate to prove its identity. The certificate service verifies the TLS client certificate by checking, among other things, the signature and validity of the TLS client certificate. If the TLS client certificate is valid, the TLS connection can continue, and the subsequent integration of the system component into the communications network can take place.

[0037] The system component can sign the initial request for integration into the communications network with an associated manufacturer certificate, in particular with the so-called IDevID certificate. This is an initial certificate (Initial Device Identifier) ​​issued to the system component by its manufacturer. The IDevID certificate can advantageously be used by the system component as the previously described TLS client certificate. If, for example, it uses the so-called Certificate Management Protocol (CMP), the IDevID certificate is said to play the role of the so-called CMP signing certificate. In parallel / additionally, it uses the same certificate as a TLS client certificate for the secure transport of the signed request.

[0038] For the purpose of verifying the TLS client certificate, the certificate service can have access to certificate chains for certain trusted certification authorities of specific manufacturers or similar. This allows it to check whether the certificate chain provided by the TLS client matches a certificate chain accessible to the certificate service. Depending on the specific case, only the certificate of the root certification authority (instead of the complete certificate chain) can be considered during the verification. In addition, the end device certificate (e.g., a certificate issued by the manufacturer, such as an IDevID certificate according to IEEE 802.1AR, or a certificate provisioned for the system component by an OEM / distributor, such as an LDevID certificate) can also be considered. This simplifies the verification of the authenticity and identity of the system component.

[0039] In the event that the previously explained check by the certificate service was successful, the certificate service is preferably designed to forward the system component's request for integration into the communication network of the technical system to the registration authority or the certification authority using a TLS client certificate assigned to the certificate service.

[0040] Particularly preferably, the registration authority or the certification authority is configured to check whether the certificate service is trustworthy, in particular by comparing it with a trust inventory, for example, an inventory of the registration authority, an inventory of the certification authority, or another inventory. This further increases the security of the integration. The registration authority or the certification authority can check whether the entire certificate chain for the (signing) certificate with which the application for this component was signed is trustworthy, i.e., whether it originates from a trusted root certification authority (Root CA).

[0041] Furthermore, the registration authority or certification authority can be configured to check whether the identity of the system component is already known to them and, if it was previously unknown, to store the identity in an inventory. This facilitates the reintegration of the system component if it needs to be removed from the communication network for a certain period of time. The inventory can have familiar functionalities for filtering and searching entries, allowing the system components already known to the certificate service to be identified easily and efficiently. This is particularly advantageous when multiple certificate services are implemented.

[0042] Within the scope of an advantageous development of the invention, the certification authority is designed to transmit a certificate (such as a so-called LDevID certificate according to IEEE 802.1AR or a communication certificate for communication within the communication network of the technical system directly, or indirectly via the registration authority), to the certification service, which makes this certificate available to the system component in order to integrate it into the communication network of the technical system. In addition, the associated certificate chain or at least the certificate of the associated root certification authority (Root CA) for the above-mentioned certificate is transmitted to the system component. This certificate is also referred to as the root of trust.After the certificate transmission and the transmission of the certificate chain and the trust anchor to the system component have been completed, the secure integration of the system component into the communication network of the technical system is complete.

[0043] The previously explained object is also achieved by a computer-implemented certificate service for a control system of a technical plant, in particular a process or production plant, which is designed to establish a connection, which is designed exclusively on the basis of the HTTPS protocol, with a certification authority of the control system of the technical plant directly or indirectly via a registration authority of the control system of the technical plant, and which is designed to receive from a plant component of the technical plant an application for integration into a communication network of the technical plant exclusively on the basis of the HTTPS protocol, wherein the plant component has a certificate which represents its identity, such as a so-called Initial Device Identifier (IDevlD) certificate or a Locally Significant Device Identifier (LDevlD) certificate according to IEEE 802.1 AR) as a TLS client certificate for signing the HTTPS packet and to securely integrate the plant component into a communication system of the technical plant using a certificate management protocol supported by the plant component and involving the registration authority and / or the certification authority.

[0044] The system component receives both an application environment-specific certificate and the certificate of the root certification authority exclusively using a certificate management protocol (and in particular without the aid of a special BRSKI voucher).

[0045] In addition, the object is achieved by a method for the secure integration of a system component into a communication network of a technical system, in particular a process or production system, comprising: a) Directing a request for integration into the communication network of the technical system exclusively on the basis of the HTTPS protocol by the system component to a certificate service of a control system for the technical system, wherein the system component has its manufacturer certificate, such as its Initial Device Identifier (IDevlD) certificate according to IEEE 802.1 AR is used as the TLS client certificate for signing the HTTPS packet, and wherein the control system comprises at least one certification authority that is responsible and trained to issue and revoke certificates for system components of the technical system, b) establishing a connection or using an existing connection of the certificate service with the registration authority or the certification authority exclusively on the basis of the HTTPS protocol; c) integrating the system component with the aid of a certificate management protocol supported by the system component and involving the registration authority and / or the certification authority of the control system into the communication network of the technical system through the certificate service.

[0046] The certificate service preferably checks whether the request submitted by the plant component for integration into the technical plant's communication network includes a certificate issued by a trusted certification authority and assigned to the plant component as a TLS client certificate. This check can also be performed by the registration authority, independently of the check by the certificate service. This allows both the certificate service and the registration authority to perform a check and thus authorize requests from the plant component separately. It can be provided that a control system user can specify who should perform which check.

[0047] In case of a successful verification, the certificate service can forward the system component's request for integration into the communication network of the technical system to the registration authority or the certification authority using a TLS client certificate assigned to the certificate service.

[0048] Preferably, the certification authority transmits a certificate, such as a communication certificate for communication within the communication network of the technical system, directly or indirectly via the registration authority to the certificate service, which makes the certificate, in particular the communication certificate, available to the system component in order to integrate it into the communication network of the technical system.

[0049] In addition to this application environment-specific certificate, such as the communication certificate, the certificate of the root certification authority is also transmitted to the system component exclusively using a certificate management protocol (and in particular without the aid of a special BRSKI voucher).

[0050] Particularly preferably, the system component uses a method for automated recognition of the certificate service, in particular an mDNS, DNS / DHCP, or GRASP method, before submitting the application. This enables the system component to find the certificate service responsible for it without the assistance of an administrator or other user. Alternatively, the required address information can be entered into a configuration memory of the system component by the manufacturer / OEM / distributor / integrator in an earlier lifecycle phase, so that the system component can contact the certificate service with as little effort as possible.

[0051] The above-described properties, features and advantages of this invention, as well as the manner in which they are achieved, will become clearer and more clearly understood in connection with the following description of an embodiment which is explained in more detail in connection with the drawing.

[0052] The figure shows part of a control system 1 according to the invention for a technical plant designed as a process plant, i.e., as a process engineering plant. The control system 1 comprises a registration authority 2, a certification authority 3, and a certificate service 4. On the right side of the figure, plant components 5 are shown that are to be integrated into a communication network of the process plant in order to communicate with other plant components there.

[0053] As part of such a secure integration of one of the system components 5 into the communications network, the respective system component 5 executes a process for the automated detection of the accessible or responsible certificate service 4 as part of a first step I. This process is, for example, an mDNS, a DNS / DHCP, or a GRASP process. To perform such a process, a corresponding (discovery) agent is implemented on the system component 5.

[0054] In a subsequent step II, the plant component submits a request for integration into the process plant's communication network to the certificate service 4 of the process plant's control system. This request is transmitted to the certificate service 4 based on the HTTPS protocol, with the plant component using a certificate representing its identity, such as an Initial Device Identifier (IDevID) certificate or a Locally Significant Device Identifier (LDevID) certificate according to IEEE 802.1AR, as a TLS client certificate to sign the HTTPS packet. The request is signed by the plant component 5 with its manufacturer certificate (such as its IDevID certificate according to IEEE 802.1AR) 6, which it received from its manufacturer as part of the imprinting process at the factory.The request for integration into the communication network of the process plant, addressed by plant component 5 to certificate service 4, includes a TLS client certificate, with plant component 5 using its IDevID certificate 6 as the TLS client certificate. More specifically, the integration request is transmitted as an HTTPS data packet, with the aforementioned TLS client certificate being used to sign the HTTPS data packet.

[0055] In a third step II, the certificate service 4 validates the identity of the applicant by validating the HTTPS packet received from the system component containing the request and the TLS client certificate. To do this, the certificate service 4 checks whether the IDevID certificate 6 used as the TLS client certificate is valid and was issued by a trusted certification authority. For this purpose, the certificate service 4 can, for example, access a trust inventory 7, which is also accessible to the registration authority 2 and the certification authority 3, and compare the certification authority with the trusted certification authorities stored there.

[0056] Additionally, as part of the third step III, the Certification Service 4 checks whether the plant component 5 applying for certification is intended for integration into the process plant's communication network. To do this, the Certification Service 4 accesses, for example, delivery notes or component lists from the control system, which specify which plant components are to be integrated into the control system. If one or both checks are unsuccessful, the Certification Service 4 can contact an operator of the process plant and refuse to integrate the plant component 5 into the process plant's communication network.

[0057] If the checks are successful, the certificate service 4 forwards the plant component's application for integration into the process plant's communication network via HTTPS, created, for example, using the CMP protocol, to the registration authority 2 in a fourth step IV using a TLS client certificate 8 assigned to the certificate service. The registration authority 2 uses the Certificate Management Protocol (CMP) to check whether the HTTPS packet received by the certificate service 4 originates from a trusted certificate service. To do so, it accesses the trust inventory 7, in which (among other things) trusted certificate services are stored.

[0058] In addition, Registration Authority 2 checks whether the system component 5, which generated the integration request contained in the HTTPS packet, is already stored in Trust Inventory 7. If this is not the case, it extracts the data (in particular the name of the manufacturer, the name of System Component 5, the ID or serial number of System Component 5 from the request) and stores this data, along with the IDevID certificate 6, in Trust Inventory 7 of Registration Authority 2 (as a new inventory entry).

[0059] In the event of a successful verification, registration authority 2 forwards the application to certification authority 3. If the application is successfully validated, the certification authority 3 issues an environment-specific certificate, for example, a device-specific certificate (such as an LDevID Generic certificate), an application-specific certificate, or a communication certificate, and transmits it to plant component 5 via registration authority 2 and certificate service 4. The certificate of the root certification authority (not shown in the figure) of the process plant as the environment of use is also included in the response from certification authority 3 to plant component 5 (referred to as the "Initial Response" when using the CMP protocol).This means that the system component receives both an environment-specific certificate and the root certification authority certificate exclusively using a certificate management protocol (and without the aid of a special BRSKI voucher).

[0060] The described control system 1 and the associated integration process enable user-friendly “Secure Device Onboarding” without the need for a complex and comprehensive “Secure Device Onboarding” infrastructure.

Claims

Patent claims 1. Control system (1) for a technical plant, in particular a manufacturing or process plant, which comprises at least one certification authority (3) which is responsible and designed for issuing and revoking certificates for plant components (5) of the technical plant, characterized in that a certificate service (4) is implemented in the control system (1), which is connected to the certification authority (3) directly or indirectly via a registration authority (2) which is designed exclusively according to the HTTPS protocol, wherein the certificate service (4) is designed toto receive from a system component (5) of the technical system an application for integration of the system component (5) into a communication network of the technical system exclusively on the basis of the HTTPS protocol and to integrate the system component (5) into the communication network of the technical system with the aid of a certificate management protocol supported by the system component (5) and with the involvement of the registration authority (2) and / or the certification authority (3).

2. Control system (1) according to claim 1, wherein the certificate service (4) is designed to compare an identification of the system component (5) to be integrated into the control system (1) with information from the control system (1), which information includes statements about which system components (5) are intended for integration into the communication network of the technical system.

3. Control system (1) according to claim 2, wherein the certificate service (4) is designed to notify an operator of the control system (1) of the result of the check.

4. Control system (1) according to claim 2 or 3, wherein the certificate service (4) is designed to refuse the integration of the system component (5) into the communication network of the technical system if the test has shown that the integration is not intended according to the information from the control system (1).

5. Control system (1) according to one of the preceding claims, in which the certificate service (4) or the registration authority (2) is designed to check whether the application for integration into the communication network addressed to it by the system component (5) the technical system comprises a certificate issued by a trusted certification authority and assigned to the system component (5) as a TLS client certificate (6).

6. Control system (1) according to claim 5, wherein the certificate service (4) or the registration authority (2) is designed to forward the application of the system component (5) for integration into the communication network of the technical system to the registration authority (2) or the certification authority (3) using a TLS client certificate (6) assigned to the certificate service (4) in the event of a successful check.

7. Control system (1) according to one of the preceding claims, in which the registration authority (2) or the certification authority (3) are designed to check whether the certificate service (4) is trustworthy, in particular by comparing it with a trust inventory (7), preferably a trust inventory (7) of the registration authority (2) or the certification authority (3).

8. Control system (1) according to one of the preceding claims, in which the registration authority (2) or the certification authority (3) are designed to check whether an identity of the system component (5) is already known to them and, in the event that this identity was not previously known, to store the identity in an inventory, in particular the trust inventory (7).

9. Control system (1) according to one of the preceding claims, in which the certification authority (3) is designed to transmit a communication certificate for communication within the communication network of the technical installation directly, or indirectly via the registration authority (2), to the certification service (5), which makes the communication certificate available to the installation component (5) in order to integrate it into the communication network of the technical installation.

10. Computer-implemented certificate service for a control system (1) of a technical installation, in particular a process or production plant, which is designed to establish a connection with a certification authority (3) of the control system (1) of the technical installation directly or indirectly via a registration authority (2) of the control system (1) of the technical installation, exclusively on the basis of the HTTPS protocol, and which is designed to receive from a system component (5) of the technical installation an application for integration into a communication network of the technical installation exclusively on the basis of the HTTPS protocol and to use the system component (5) exclusively un- to be securely integrated into a communication system of the technical system with the aid of a certificate management protocol supported by the system component (5) and with the involvement of the registration authority (2) and / or the certification authority (3).

11. Method for the secure integration of a system component (5) into a communication network of a technical system, in particular a process or production system, comprising: a) sending a request for integration into the communication network of the technical system exclusively on the basis of the HTTPS protocol by the system component (5) to a certificate service (4) of a control system (1) for the technical system, wherein the control system (1) comprises at least one certification authority (3) which is responsible and trained for issuing and revoking certificates for system components (5) of the technical system, b) establishing a connection or using an existing connection of the certificate service (4) with the registration authority (2) or the certification authority (3) exclusively on the basis of the HTTPS protocol;c) integrating the system component (5) with the aid of a certificate management protocol supported by the system component (5) and involving the registration authority (2) and / or the certification authority (3) of the control system (1) into the communication network of the technical system by the certification service (4); 12. The method according to claim 11, wherein the certificate service (4) checks whether the request addressed to it by the system component (5) for integration into the communication network of the technical system includes a certificate issued by a trustworthy certification authority and assigned to the system component (5) as a TLS client certificate (6).

13. The method according to claim 12, wherein, in the event of a successful check, the certificate service (4) forwards the application of the system component (5) for integration into the communication network of the technical system to the registration authority (2) or the certification authority (3) using a TLS client certificate (6) assigned to the certificate service (4).

14. Method according to one of claims 11 to 13, wherein the certification authority (3) transmits a certificate for authentication and / or communication within the communication network of the technical installation directly, or indirectly via the registration authority (2), to the certification service (4), which makes the communication certificate available to the installation component (5) in order to integrate it into the communication network of the technical installation.

15. Method according to one of claims 11 to 14, wherein the system component (5) uses a method for automated recognition of the certificate service (4), in particular an mDNS, DNS / DHCP or a GRASP method.

Images