DE102020120300A1 - Method for detecting any manipulation of an automation component - Google Patents

Abstract

The invention includes a network device (NG) with a first interface (SN1) and an electronic unit (EE), the first interface (SN1) being designed to transmit data, in particular data from at least one field device (FG) of automation technology, in accordance with an OPC To receive the UA protocol wirelessly, the network device (NG) being designed to display the received data and/or process it further by means of the electronics unit (EE), and a system for the manipulation-free transmission of data from a field device (FG) of automation technology, which inventive network device (NG) includes.

Description

The invention relates to a method for detecting any manipulation of an automation component, and to such an automation component which is designed for use in the method according to the invention.

Automation components that are used in industrial plants are already known from the prior art. For example, field devices are used as automation components, which are used in process automation technology as well as in production automation technology. In principle, all devices that are used close to the process and that supply or process process-relevant information are referred to as field devices. Thus, field devices are used to record and/or influence process variables. Measuring devices or sensors are used to record process variables. These are used, for example, for pressure and temperature measurement, conductivity measurement, flow measurement, pH measurement, level measurement, etc. and record the corresponding process variables pressure, temperature, conductivity, pH value, level, flow rate, etc. Actuators are used to influence process variables. These are, for example, pumps or valves that can influence the flow of a liquid in a pipe or the fill level in a container. In addition to the field devices mentioned above, automation components are also understood to mean gateways, edge devices, remote I/Os, wireless adapters or devices in general that are arranged at the field level.

A large number of such field devices are produced and sold by the Endress+Hauser Group.

In modern industrial plants, field devices are usually connected to higher-level units via communication networks such as fieldbuses ( ^Profibus® , Foundation® ^Fieldbus , ^HART® , etc.). Normally, the superordinate units are control systems or control units, such as a PLC (programmable logic controller) or a PLC (programmable logic controller). The higher-level units are used, among other things, for process control, process visualization, process monitoring and for commissioning the field devices. The measured values recorded by the field devices, in particular by sensors, are transmitted via the respective bus system to one (or optionally several) higher-level unit(s). In addition, data transmission from the higher-level unit via the bus system to the field devices is also required, in particular for the configuration and parameterization of field devices and for the control of actuators.

Custody transfer systems are used in the oil and gas industry, among other things, and are used for transactions and the transport of physical substances between two operators - supplier and recipient. Such a custody transfer system contains one or more automation components, which are used to record the quantity of a transported physical substance and to store the data of the transactions. All transactions must be carried out and recorded in a tamper-proof and incontestable manner. The automation components, in particular the field devices, must be verified and calibrated and certified in this regard by an authority.

Automation components used in such custody transfer systems are checked by an authorized person for correct installation and configuration. The automation component is then mechanically and/or electronically sealed. Calibration documentation is often printed out on paper. Afterwards, the automation components are often unattended.

A validation of an automation component, in particular with regard to the question of whether the automation component is still sealed or whether the configuration is changed, must be checked manually on site.

A broken seal, which was caused by unauthorized opening, can only be proven afterwards and only directly on site, since there is no active alarm. An authorized person thus has to travel to individual automation components from time to time, which is time-consuming and expensive. Furthermore, a chronological assignment of the breaking of the seal is not possible. In addition, the degree of manipulation of an automation component, in particular with regard to the configuration data, is often not readily ascertainable.

The object of the invention is to verify the sealing of an automation component from a remote location.

• - Auslesen des Datensatzes durch eine erste Instanz, wobei die erste Instanz einen zweiten privaten Schlüssel und zweite Verifikationsdaten aufweist;
• - Erzeugen einer ersten digitalen Signatur mittels der ersten Instanz durch kryptographisches Signieren des Datensatzes durch die erste Instanz unter Verwendung des zweiten privaten Schlüssels;
• - Schreiben der ersten digitalen Signatur und der zweiten Verifikationsdaten von der ersten Instanz in die Automatisierungskomponente;
• - Erzeugen einer zweiten digitalen Signatur mittels der Automatisierungskomponente durch kryptographisches Signieren des Datensatzes, der ersten digitalen Signatur und der zweiten Verifikationsdaten unter Verwendung des ersten privaten Schlüssels;
• - Erzeugen eines digitalen Siegels mittels der Automatisierungskomponente, wobei das digitale Siegel den Datensatz, die erste digitale Signatur, die zweite digitale Signatur, und die ersten Verifikationsdaten umfasst;
• - Auslesen des digitalen Siegels mittels einer zweiten Instanz;
• - Verifizieren der ersten digitalen Signatur durch die zweite Instanz mittels der zweiten Verifikationsdaten;
• - Verifizieren der zweiten digitalen Signatur durch die zweite Instanz mittels der ersten Verifikationsdaten;
• - Erzeugen einer Alarmmeldung durch die zweite Instanz, im Falle, dass die erste digitale Signatur und/oder die zweite digitale Signatur nicht erfolgreich verifiziert werden kann.

The object is achieved by a method for detecting any manipulation of an automation component, the automation component having a data set, a first private key and first verification data indicates which data set includes parameter values, formulas, calibration data, firmware versions, checksums and/or identification data, in particular a serial number or a device tag, the method including the following method steps:

• - Reading out the data set by a first entity, the first entity having a second private key and second verification data;
• - Generating a first digital signature by means of the first instance by cryptographically signing the data set by the first instance using the second private key;
• - Writing the first digital signature and the second verification data from the first entity to the automation component;
• - Generating a second digital signature by means of the automation component by cryptographically signing the data set, the first digital signature and the second verification data using the first private key;
• - Generating a digital seal by means of the automation component, the digital seal comprising the data record, the first digital signature, the second digital signature, and the first verification data;
• - Reading the digital seal by means of a second instance;
• - Verification of the first digital signature by the second entity using the second verification data;
• - Verification of the second digital signature by the second entity using the first verification data;
• - Generation of an alarm message by the second entity in the event that the first digital signature and/or the second digital signature cannot be successfully verified.

The advantage of the method according to the invention is that it can be checked from a remote location whether the data record stored in an automation component has been changed or not. The data record is sent to a first instance, for example an authority, which checks the data record, for example whether calibrations have been carried out correctly. The first instance then signs the data record and certifies the automation component in this way.

The automation component then creates a digital seal. This can be read out by a further instance, for example a plant operator, and checked using verification data which are supplied by the first instance and by the automation component. If changes were made to the data record, or if the digital seal was manipulated, one or more of the digital signatures cannot be successfully verified. An alarm message, for example, is then displayed to the system operator.

It is advantageously provided that the method according to the invention, in particular the steps of generating the digital signatures and the digital seal, is repeated if an authorized and documented change is made to the data record.

According to an advantageous embodiment of the method according to the invention, it is provided that the first verification data or the second verification data comprise digital certificates and/or public keys. The respective digital signatures can be verified in a simple manner by means of the digital certificates or the public keys.

• - Übermitteln der ersten digitalen Signatur und der zweiten Verifikationsdaten an die weitere Instanz;
• - Erzeugen einer weiteren digitalen Signatur mittels der weiteren Instanz durch kryptographisches Signieren des Datensatzes, der ersten digitalen Signatur und der zweiten Verifikationsdaten unter Verwendung des weiteren privaten Schlüssels;
• - Schreiben der weiteren digitalen Signatur und der weiteren Verifikationsdaten von der weiteren Instanz in die Automatisierungskomponente;
• - Erzeugen der zweiten digitalen Signatur mittels der Automatisierungskomponente durch kryptographisches Signieren des Datensatzes, der weiteren digitalen Signatur und der weiteren Verifikationsdaten unter Verwendung des ersten privaten Schlüssels;
• - Erzeugen eines digitalen Siegels mittels der Automatisierungskomponente, wobei das digitale Siegel den Datensatz, die weitere digitale Signatur, die zweite digitale Signatur, und die ersten Verifikationsdaten umfasst;
• - Auslesen des digitalen Siegels mittels der zweiten Instanz;
• - Verifizieren der ersten digitalen Signatur durch die zweite Instanz mittels der zweiten Verifikationsdaten;
• - Verifizieren der weiteren digitalen Signatur durch die zweite Instanz mittels der weiteren Verifikationsdaten;
• - Verifizieren der zweiten digitalen Signatur durch die zweite Instanz mittels der ersten Verifikationsdaten;
• - Erzeugen einer Alarmmeldung durch die zweite Instanz, im Falle, dass die erste digitale Signatur, die weitere digitale Signatur und/oder die zweite digitale Signatur nicht erfolgreich verifiziert werden kann.

According to a development of the method according to the invention, it is provided that at least one further instance is provided, the first instance having a further private key and further verification data, in particular a further digital certificate and/or a further public key, further comprising:

• - Transmission of the first digital signature and the second verification data to the further instance;
• - Generating a further digital signature by means of the further instance by cryptographically signing the data set, the first digital signature and the second verification data using the further private key;
• - Writing the further digital signature and the further verification data from the further instance into the automation component;
• - Generating the second digital signature by means of the automation component by cryptographically signing the data record, the further digital signature and the further verification data using the first private key;
• - Generating a digital seal by means of the automation component, the digital seal comprising the data record, the further digital signature, the second digital signature and the first verification data;
• - Reading the digital seal by means of the second instance;
• - Verification of the first digital signature by the second entity using the second verification data;
• - Verification of the additional digital signature by the second entity using the additional verification data;
• - Verification of the second digital signature by the second entity using the first verification data;
• - Generation of an alarm message by the second instance in the event that the first digital signature, the further digital signature and/or the second digital signature cannot be successfully verified.

The data record is thus digitally signed by another entity, for example another authority or by a computer belonging to the plant operator. A further level of security is thus added. Provision can be made for a large number of other instances to repeat the steps listed above in order to generate a large number of digital signatures.

According to an advantageous embodiment of the method according to the invention, it is provided that the steps of reading and writing take place via a secure data channel, in particular formed via an OPC UA network. By default, OPC UA (“Open Platform Communication Unified Architecture”) allows transmitted data to be encrypted. As a result, the steps of reading out and transmitting can be carried out in a tamper-proof manner.

According to an advantageous embodiment of the method according to the invention, it is provided that the field device and/or the second entity is in communication with a higher-level unit via an OPC UA network and the automation component or the second entity converts the alarm message as a device status into cyclic, Inserts OPC UA telegrams requested by the higher-level unit. By default, OPC UA telegrams contain a device status. In this refinement, the device status is changed if the corresponding digital signatures could not be successfully verified and manipulation is therefore suspected. For example, the device status can be changed to "Verification failed" or "Needs verification".

According to an advantageous embodiment of the method according to the invention, it is provided that if an alarm message is generated, the automation component is switched off or a communication functionality of the automation component is deactivated. This can happen automatically so that no damage to the process or manipulation of the value stream occurs, especially in custody transfer applications or in safety-critical applications.

According to an advantageous embodiment of the method according to the invention, it is provided that the digital signatures include hash values of the data set, which are generated using the respective private key. As a result, the data record currently in the automation component can be compared with the data record read out at the time a signature was generated. This must be the same if there has been no undocumented change to the dataset. In the event that the record differs, the respective signature cannot be verified successfully, whereupon the alarm message is generated.

The object is also achieved by an automation component which is designed for use in the method according to the invention. For this purpose, the automation component requires appropriate software or firmware, which is loaded onto the automation component by an authorized person before the method is carried out. The version of the software and the time of uploading is added to the record.

According to an advantageous embodiment of the automation component according to the invention, it is provided that the automation component is a field device which is designed to detect a physical measured variable of a process engineering process or to influence a process variable.

Field devices, which are mentioned in connection with the method according to the invention, have already been listed as examples in the introductory part of the description.

According to an alternative advantageous embodiment of the automation component according to the invention, it is provided that the automation component is a control system, an industrial gateway, a remote I/O, a plant access point or an edge device.

• 1: ein Ausführungsbeispiel des erfindungsgemäßen Verfahrens; und
• 2: eine Detaillierung des Ausführungsbeispiels.

The invention is explained in more detail with reference to the following figures. Show it

• 1 : an exemplary embodiment of the method according to the invention; and
• 2 : a detail of the embodiment.

In 1 an exemplary sequence of the method according to the invention with method steps 1.) to 10.) is shown schematically. In the present example, a field device is used as the automation component AK, specifically a flow meter for detecting a mass flow of a measurement medium that flows through a pipeline. The field device can be used in a custody transfer system, for example, and the measurement medium is crude oil, for example. In such a system it is of great importance that the measured values of the field device are calibrated and cannot be manipulated. The field device must be calibrated for this. The calibration data or calibration certificates, together with other data such as identification data of the automation component AK, parameter values of the automation component AK, the current firmware version, etc., are stored in a data record DS on the automation component AK. Furthermore, the automation component has a first private key and first verification data VD1. These components are used in a later process step. Verification data, which are mentioned in this method step and in further method steps, have a public key and/or digital certificates, for example.

Alternatively, a network device, for example a gateway, a flow computer, an edge device, etc. can be used as the automation component AK.

In a first method step 1.), the data record DS is read out by a first entity IN1. All data transmission processes (reading and transmission), which are mentioned in this and the following method steps, are carried out via a communication network that uses OPC UA as a protocol. This protocol allows data to be transmitted without manipulation. The first entity IN1 is, for example, an authority.

In a second method step 2.), the authority checks the data record DS, in particular the identification data, parameter values, firmware versions, checksums, calibration certificates and/or the amount of measurement medium that has flowed through the automation instrument, and signs the data record DS cryptographically, in particular by forming a hash value of the data record DS. The authority has a second private key KY2 for this purpose. This creates a first digital signature SN1, which contains the hash value and an identification of the first instance IN1. Furthermore, the first instance IN1 has second verification data VD2, which allow conclusions to be drawn about the correctness of the data record DS and the identity of the first instance IN1. For example, the verification data VD2 is a public key that corresponds to the private key KY2.

• H bezeichnet den Hashwert des Datensatzes DS.

The verification can be carried out as follows:

• H designates the hash value of the data record DS.

This is formed by H = f(DS), where f denotes a hash function.

g denotes an asymmetric cryptographic function.
This forms SN1 = g(DS, K2).

g' denotes an asymmetric cryptographic function for decrypting what was encrypted by g. $$\text{So is DS}=\text{G'}\left(\text{<figure-callout id="1" label="SN" filenames="DE102020120300A1\_0002.png,DE102020120300A1\_0003.png" state="{{state}}">SN</figure-callout>}\mathrm{1,}\text{vd}2\right).$$

The hash value can then be verified by f(DS)=g'(SN1, VD2). So if the hash value is equal to the decryption of the first digital signature, the verification is successful.

In a third method step 3.), the first entity IN1 transmits the first digital signature SN1 and the second verification data to the automation component AK, whereupon this data is written to the automation component AK.

In a fourth method step 4.), the automation component generates a second digital signature SN2. For this purpose, the data record DS, the first digital signature SN1 and the second verification data VD2 are cryptographically signed using the first private key KY1, in particular by forming a hash value or by encrypting the data.

• Nach Erstellen des digitalen Siegels SG überträgt die Automatisierungskomponente AK dieses in einem Verfahrensschritt 5.) an eine externe Datenbank, beispielsweise an eine cloudbasierte Datenbank. Alternativ verbleibt das digitale Siegel SG in einem Datenspeicher der Automatisierungskomponente AK. Eine zweite Instanz IN2, beispielsweise eine weitere Behörde oder der Anlagenbetreiber, liest das digitale Siegel SG in einem Verfahrensschritt 6.) aus der Datenbank, bzw. der Automatisierungskomponente AK aus. Unter Verwendung der zweiten Verifikationsdaten VD2 verifiziert die zweite Instanz in einem Verfahrensschritt 7.) die erste Signatur SN1, also insbesondere die Identität der ersten Instanz IN.

The automation component then creates a so-called digital seal SG. This contains the data record DS, the first digital signature SN1, the second digital signature SN2 and the first verification data VD1. With each qualified update to the data record DS, method steps 1.) to 4.) are repeated. As a result, the contents of the digital seal SG always correspond to the current data record DS. If the data record DS is manipulated by an unauthorized person, the content of the digital seal SG no longer corresponds to the data record. An unauthorized person cannot update the digital seal, since at least one instance IN1 is always involved for this, over which he has no can exercise control. Checking the digital seal SG for consistency with the current data record DS is described below:

• After creating the digital seal SG, the automation component AK transfers this to an external database, for example a cloud-based database, in a method step 5.). Alternatively, the digital seal SG remains in a data memory of the automation component AK. A second entity IN2, for example another authority or the plant operator, reads the digital seal SG in a method step 6.) from the database or the automation component AK. Using the second verification data VD2, the second entity verifies in a method step 7.) the first signature SN1, ie in particular the identity of the first entity IN.

If the first signature SN1 could be verified correctly, the second instance IN2 reads out the current data set DS from the automation component AK in a method step 8.). In a method step 9.), the second entity IN2 then verifies the second digital signature using the first verification data VD1, for example by decrypting the data record and comparing the decrypted data record with the current data record DS.

In a method step 10.), the result is then made known. If the first signature SN1 and the second signature SN2 could be successfully verified, then the data record DS was not changed without authorization. If one or both of the signatures SN1, SN2 cannot be verified successfully, the current data record DS stored in the automation component AK may have been manipulated. In this case an alarm message is generated, for example directly in the second entity IN2. Alternatively, the cyclical status of the automation component, which is retrieved from a higher-level unit, is changed. For this purpose, the automation component AK is in communication connection with the superordinate unit, for example a control unit, via an OPC UA network. The device status is inserted into the cyclic OPC UA telegrams requested by the higher-level unit, so that an alarm message is automatically detected. As a reaction, for example, the communication functionality of the automation component is restricted.

In order to further increase the security of the method according to the invention, additional entities INx, INn are provided, which generate additional digital signatures SNx, SNn.

In 2 this is made clear: after the third method step 3.), the digital seal SG is not generated directly. First, the first digital signature and the second verification data are transmitted to the further instance INx in a method step 1.a).

In a method step 2.a), the further entity INx generates a further digital signature SNx by cryptographically signing the data record (DS), the first digital signature SN1 and the second verification data VD2 using a further private key KYx assigned to the further entity. In a Method step 3.a), the further instance INx transmits the further digital signature SNx the further verification data VDx to the automation component AK, whereupon this data is written into the automation component.

These method steps can then be repeated up to an nth instance (see steps 1.n), 2n), 3.n)) in order to generate further digital signatures SNn using further private keys KYn. Each additional digital signature SNn is then written to the automation component AK.

The automation component then creates the digital seal DS (similar to method step 4.) ff.). This contains all of the entities IN1, INx, ..., INn and the automation component itself generated digital signatures SN1, SN2, SNx, ..., SNn, all verification data VD1, VD2, VDx, ..., VDn and the data record itself. An unauthorized person would have to exercise control over all instances IN1, INx, ..., INn in order to change the data record DS and to write this update in the digital seal SG.

Finally, the second instance IN2 verifies all digital signatures SN1, SN2, SNx, . If just one of the digital signatures SN1, SN2, SNx, . . . , SNn cannot be verified, the alarm message is generated.

The method according to the invention is particularly suitable for use in custody transfer systems in which transactions must be carried out and recorded in a tamper-proof and incontestable manner.

Reference List

1.), ..., 10.)

process steps

AK

automation component

AL

alarm message

DS

record

IN1, IN2, INx, ..., INn

first instance, second instance, further instance, nth instance

KY1, KY2, KYx, ..., KYn

private keys

SG

digital seal

SN1, SN2, SNx, ..., SNn

digital signatures

VD1, VD2, VDx, ..., VDn

verification data

Claims (10)

A method for detecting any manipulation of an automation component (AK), the automation component (AK) having a data set (DS), a first private key (KY1) and first verification data (VD1), which data set (DS) has parameter values, formulas, calibration data, Firmware versions, checksums and/or identification data, in particular a serial number or a device tag, the method comprising the following method steps: - Reading out the data set (DS) by a first entity (IN1), the first entity (IN1) having a second private key (KY2) and second verification data (VD2); - Generating a first digital signature (SN1) by means of the first entity (IN1) by cryptographically signing the data set (DS) by the first entity (IN1) using the second private key (KY2); - Writing the first digital signature (SN1) and the second verification data (VD2) from the first entity (IN1) in the automation component (AK); - Generating a second digital signature (SN2) by means of the automation component (AK) by cryptographically signing the data record (DS), the first digital signature (SN1) and the second verification data (VD2) using the first private key (KY1); - Generating a digital seal (SG) by means of the automation component (AK), the digital seal (SG) containing the data record (DS), the first digital signature (SN1), the second digital signature (SN2), and the first verification data (VD1 ) includes; - Reading the digital seal (SG) by means of a second entity (IN2); - Verifying the first digital signature (SN1) by the second entity (IN2) using the second verification data (VD2); - Verifying the second digital signature (SN2) by the second entity (IN2) using the first verification data (VD1); - Generation of an alarm message (AL) by the second entity (IN2) in the event that the first digital signature (SN1) and/or the second digital signature (SN2) cannot be successfully verified. procedure after claim 1 , wherein the first verification data (VD1) or the second verification data (VD2), digital certificates and/or public keys. Method according to at least one of Claims 1 or 2 , wherein at least one further instance (INx, INn) is provided, the first instance (IN1) having another private key (KYx, KYn) and further verification data (VDx, VDn), in particular another digital certificate and/or another public one Key having, further comprising: - Transmission of the first digital signature (SN1) and the second verification data (VD2) to the further entity (INx, INn); - Generating a further digital signature (SNx, SNn) by means of the further entity (INx, INn) by cryptographically signing the data record (DS), the first digital signature (SN1) and the second verification data (VD2) using the further private key ( KYx, KYn); - Writing the further digital signature (SNx, SNn) and the further verification data (VDx, VDn) from the further instance (INx) into the automation component (AK); - Generating the second digital signature (SN2) by means of the automation component (AK) by cryptographically signing the data set (DS), the further digital signature (SNx, SNn) and the further verification data (VDx, VDn) using the first private key (KY1 ); - Generating a digital seal by means of the automation component (AK), the digital seal comprising the data set (DS), the further digital signature (SNx, SNn), the second digital signature (SN2), and the first verification data (VD1); - Reading the digital seal by means of the second instance (IN2); - Verifying the first digital signature (SN1) by the second entity (IN2) using the second verification data (VD2); - Verifying the additional digital signature (SNx, SNn) by the second entity (IN2) using the additional verification data (VDx, VDn); - Verifying the second digital signature (SNx, SNn) by the second entity (IN2) using the first verification data (VD1); - Generation of an alarm message (AL) by the second entity (IN2) in the event that the first digital signature (SN1), the further digital signature (Snx, Snn) and/or the second digital signature (SN2) are not successfully verified can. Method according to at least one of the preceding claims, wherein the steps of reading out and writing take place via a secure data channel, in particular formed via an OPC UA network. Method according to at least one of the preceding claims, wherein the field device and/or the second entity (IN2) is in communication with a higher-level unit via an OPC UA network and wherein the automation component (AK) or the second entity (IN2) inserts the alarm message (AL) as device status in cyclic OPC UA telegrams requested by the higher-level unit. Procedure according to at least one Claims 1 until 4 , In the event that an alarm message (AL) is generated, the automation component (AK) is switched off or a communication functionality of the automation component (AK) is deactivated. Method according to at least one of the preceding claims, wherein the digital signatures (SN1, SN2, ..., SNx, ..., SNn) haveh values of the data record (DS) which are generated using the respective private keys (KY1, KY2, ... , KYx, ..., KYn) are generated. Automation component (AK), which for use in a method according to at least one of Claims 1 until 7 is designed. Automation component (AK) after claim 8 , wherein the automation component (AK) is a field device which is designed to detect a physical measured variable of a technical process or to influence a process variable. Automation component (AK) after claim 8 , where the automation component (AK) is a control system, an industrial gateway, a remote I/O, a plant access point or an edge device.

Images