OPC UA Certificate Management Using Pre-Shared Trust Anchors
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The initial deployment and management of cryptographic assets for secure communication in industrial automation systems, such as OPC UA, are complex, error-prone, and laborious, requiring significant effort and infrastructure.
Innovation Solution
An industrial automation system device equipped with a secure communication processing unit that generates and manages shared asymmetric key pairs and certificates using a pre-shared secret, simplifying the setup and reducing the need for complex certificate management by deriving all necessary cryptographic assets from this secret.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional certificate management methods are used for secure communication setup, then security is established, but deployment complexity and labor effort increase significantly
Solution Approach 1:
The patent applies preliminary action by pre-configuring a shared secret in the device before deployment. This pre-configured secret enables automatic key pair generation and certificate creation without requiring manual certificate management during deployment, thus reducing complexity while maintaining security
Solution Approach 2:
The device performs self-service by automatically generating its own asymmetric key pair and creating its certificate using the pre-configured shared secret. The device independently completes the certificate management process without external intervention, reducing deployment effort and complexity
2Reliability
If manual certificate provisioning is performed for each device, then secure communication is established, but deployment time and labor costs increase
Solution Approach 1:
Each device autonomously generates its cryptographic assets (key pairs and certificates) using its pre-configured shared secret, eliminating the need for manual certificate provisioning. This self-service approach dramatically reduces deployment time and labor costs while ensuring each device has the necessary security credentials
Solution Approach 2:
The shared secret is pre-configured in the device during manufacturing, enabling rapid automatic certificate generation at deployment time. This preliminary preparation eliminates time-consuming manual certificate provisioning processes while maintaining security requirements
3Reliability
If comprehensive certificate stores are maintained for all communication partners, then trust verification is ensured, but management effort and infrastructure requirements increase
Solution Approach 1:
The patent extracts the essential trust verification function from complex certificate chain management. By using a pre-configured shared secret to generate and verify certificates, the system isolates the critical trust element (the shared secret) from the cumbersome process of managing comprehensive certificate stores for all communication partners
Solution Approach 2:
The shared secret is pre-configured to establish the foundation of trust before any communication occurs. This preliminary trust establishment simplifies ongoing certificate management by providing a consistent basis for verifying communication partners without requiring comprehensive certificate stores
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
The present invention relates to an industrial automation system device (100) comprising a secure communication processing unit (102) configured to communicate securely with a further trusted industrial automation system device; and a pre-shared secret module (104) comprising a pre-shared secret (202), the pre-shared secret (202) comprising shared asymmetric key pair generation data. The secure communication processing unit (102) is configured to derive a shared asymmetric key pair (204), comprising a shared secret key sk_CA and a shared public key pk_CA from the shared asymmetric key pair generation data, derive a shared certificate C_CA (206) comprising the shared public key pk_CA, and to sign the shared certificate C_CA with the derived shared secret key sk_CA; and wherein the secure communication processing unit (102) is further configured to generate a device asymmetric key pair (208) comprising a device secret key sk_i and a device public key pk_i.