As part of the digitalization of production processes, the IT security of production facilities is becoming increasingly important. End-to-end networking in companies, vertical integration and the trend towards flatter system hierarchies require end-to-end approaches to IT security in production. "Previous concepts, which mainly rely on isolating production systems, must be supplemented by new measures that provide protection for the components," explains Karsten Schneider, Chairman of the German PI branch of the Profibus User Organization (PNO). "The aim is therefore to protect Profinet at the protocol level."

PI has presented the basis for this in the white paper "Security extensions for Profinet", which is based on the international standard IEC 62443. Various protection goals for Profinet play a role here. Integrity has a high priority, for example the prevention or detection of data manipulation or the suppression of device alarms. In addition, changing the configuration of IO devices during operation must be secured by authorization. However, the robustness of the system and therefore the availability of the system must also be taken into account.

The analysis of the protection objectives results in different priorities, so that PI now defines three security classes: Robustness, Integrity + Authenticity and Confidentiality. The authenticity of the Profinet participants can be protected by a cryptographically secured digital identity, for example in the form of certificates. The integrity of communication can be ensured by cryptographic checksums, for example.

The necessary specification tasks have now been outlined and initial measures for Security Class 1 (Robustness) have been defined. These are now being incorporated into the Profinet GSDML specifications - such as the signing of GSD files, access controls for network management services (SNMP) and a "read-only" function for configuration information such as the device name. At the same time, work is underway to develop the other security classes. "We are thus ensuring that Profinet is equipped for the requirements of Industry 4.0 and can serve as a future-oriented platform for the IIoT," concludes Karsten Schneider.