Secure Communication; Basics Of Secure Communication - Siemens SIMATIC S7-1500 Function Manual

Communications services

3.6 Secure Communication

3.6 Secure Communication
3.6.1

Basics of Secure Communication

For STEP 7 (TIA Portal) as of V14 and for S7-1500 CPUs as of firmware V2.0, the options
for secure communication have been broadened considerably.
Introduction
The attribute "secure" is used for the identification of communication mechanisms that are
based on a Public Key Infrastructure (PKI) (for example RFC 5280 for Internet X.509 Public
Key Infrastructure Certificate and Certificate Revocation List Profile). A Public Key
Infrastructure (PKI) is a system that can issue, distribute and check digital certificates. The
digital certificates issued are used in the PKI to secure computer-based communication. If a
PKI uses asymmetric key cryptography, the messages in a network can be digitally signed
and encrypted.
Components that you have configured in STEP 7 for secure communication use an
asymmetric key encryption scheme with a Public Key and Private Key. TLS (Transport Layer
Security) is used as the encryption protocol. TLS is the successor for the SSL (Secure
Sockets Layer) protocol.
Objectives of secure communication
Secure communication is used to achieve the following objectives:
● Confidentiality
i.e. the data are secret / cannot by read by eavesdroppers.
● Integrity
i.e. the message that reaches the recipient is the same message, unchanged, that the
sender sent. The message has not been altered on the way.
● End point authentication
i.e. the end point communication partner is exactly who it claims to be and the party who
is to be reached. The identity of the partner has been checked.
These objectives were in the past primarily relevant to IT and networked computers. Now,
industrial machinery and control systems with sensitive data are at equally high risk, as they
are also networked, and consequently pose strict security requirements for data exchange.
Protection of the automation cell by means of the cell protection concept through firewall, or
via connection through VPN, for example with the security module, was common in the past
and remains so.
However, it is becoming increasingly necessary to also transfer data to external computers in
encrypted form via Intranet or public networks.
34
Function Manual, 11/2019, A5E03735815-AH
Communication