Exporting Digitally Signed Xml Files - Siemens SIMATIC PCS 7 Operating Manual

Export from PAA to PCS 7

17.3 Exporting digitally signed XML files:

17.3 Exporting digitally signed XML files:
Note
Security when performing data exchange via XML format
● Access to the transfer medium/transfer directory:
When using the indirect data exchange via XML format between PAA and PCS 7, ensure
that the transfer medium or the transfer directory of the XML files is only accessible to
authorized persons.
● Digitally signed XML files:
To describe the origin and integrity of the XML data, you can sign the XML file digitally during
the data exchange in XML format. This corresponds to the requirements of the PCS 7
security concept.
By checking the digital signature, you ensure that the XML file on the transfer medium has
not been modified.
The digital signature on the XML file is deactivated by default. Activating the digital signature
is recommended.
See also chapter Overview of data exchange with PCS 7 (Page 15).
Requirement
To sign the XML file, the following objects must be available on the PC:
● The certificate of the user that is signing.
This certificate can be created by a commercial provider or via a "Windows Server
Certification Authority" and must be saved in the Windows "MMC" console under "Current
user > Certificates". The corresponding "CA" certificate must be saved in the "MMC"
console under "Trusted Root Certification Authorities".
For this certificate, in the properties of the "Key usage" attribute, at least one of the values
must be set, either"Digital signature" ("digitalSignature") or "non-repudiation"
("nonRepudiation").
● The Private Key for this certificate.
Procedure
To use the digital signature in the PCS 7 project, in the plugin "Import / Export PCS 7" in the
"Export" tab in the "Project selection" control group, activate the option "XML signature".
Standards applied
The RSA asymmetric signature procedure is used, according to standard "PKCS#1
www.ietf.org/rfc/rfc3447.txt)". The attributes of the certificate are described in the certificate
definition under "Internet link (http://www.ietf.org/rfc/rfc5280.txt)".
166
Plant Automation Accelerator 3.0
Operating Manual, 04/2019, A5E46351208-AA
(https://