Web-Seminar
Shaping a globally secure Industrie 4.0 Ecosystem
IIoT Value Chain Security- The Role of TrustworthinessWhitepaper 2020
14th October 2020

Agenda⁃RRI(Japan) & PI4(Germany) collaboration, The goal of our activity⁃White Paper (IIOT Value Chain Security –The Role of Trustworthiness) 2020

- Next Steps⁃Security questionnaires for suppliers⁃

RRI Next Steps

2

Introduction
Plattform Industrie 4.0, Germany and Robot Revolution
Initiative, Japan had been collaborating since 2017 on topics
concerning security of Industrial IoT (IIoT) and Industry 4.0 usecases.
This whitepaper is the result of collaboration activities in 2019.

The overall aim of the whitepaper is to provide considerations
and possibilities for supporting ad-hoc trustworthy
relationships between companies, regardless of their businesshistories or their geographical locations.

3
https://www.plattformi40.de/PI40/Redaktion/EN/Downloads/Publikation/IIoT_Value_Chain_Security.html

Motivation
Consider a manufacturer in Germany that wants to establish a new business with a potential
supplier based in Japan. They do not have a business history, i.e. they have not worked together
on any joint projects in the past.
At this stage, they require support for quick and trustworthy collaboration.
The aim of this activity is to provide support tocompanies so that they can find trustworthy
collaboration partners easily and can establish
trustworthy relationships on-the-go.

4Main Considerations
Key Issues:• How to define trustworthiness in the context of supply/value chain security?

• Which criteria can be used to determine the trustworthiness of a company and its products?

• What kind of mechanisms are needed for assuring trustworthiness, with respect to supply/value

chain security, globally?

5TrustworthinessIn the context of our project, the definition of the term ‘trustworthiness’ proposed by the ISO/IEC JTC1/WG13
has been adapted as:“For supply/ value chain security and risk management, the term ‘Trustworthiness’
corresponds to the supplier’s ability to meet the expectations of the potential contract
partner in a verifiable way”.
Depending on the use case and on the specific product, different characteristics would apply to fulfil
stakeholder’s expectations. These characteristics may include authenticity, integrity, resilience, availability,confidentiality, privacy, safety, accountability, and usability.
For the selected use case, the following trustworthiness criteria have been deduced:Authenticity as a property of an organization’s trustworthiness
Authenticity as a property of products’ trustworthiness
Security as a property of an organization’s trustworthiness
Security as a property of products’ trustworthiness
6Ingredients for Trustworthiness Negotiation
Standards andFrameworks

Identities …

Certificates• of organizations, such as
NTA, etc.
• of employees, such asusernames, emailaddresses, PKI certificates,etc.
• of processes, such as theunique process ID assignedby the operating systems,etc.
• of products, such asbarcodes, etc.

• Identity Authenticating
Certificates such as X.509
PKI, eIDAS, etc.

• ETSI 319 412 series• Security Certification
Certificates, such as ISO
2700x certificates, IEC
62443 certificates, etc.

• METI CPSF

• ISO/IEC 62443-x-x• NIST CSF• …

7

Trustworthiness Expectations and Capabilities Exchange Protocol
The white paper introduces a “Trustworthiness Expectations and Capabilities Exchange Protocol” (TECEP) asa technical solution to be used for trustworthiness negotiation and exchange between participating peers.

The TECEP supports automation of the existing
supplier (and/or product) qualification andselection process as well.

8Trustworthiness Profile
Trustworthiness Profile
To be filled by the Buyer

A standardized container thatcan be realized irrespective ofthe base communication
technology

To be filled by the SupplierSupplier s Information

Buyer s Information

Contact Partner:*Contact Partner s Unique Identifier:Contact Information:
Legal Entity Name:*Legal Entity Unique Identifier:*Unique Identifier Scheme: (e.g., link to LEI code repo, VATIN by DUNS, NTA by TSE, etc.)
Country:
Additional Information:

Contact Partner:*Contact Partner s Unique Identifier:Contact Information:
Legal Entity Name:*Legal Entity Unique Identifier:*Unique Identifier Scheme: (e.g., link to LEI code repo, VATIN by DUNS, NTA by TSE, etc.)
Country:
Additional Information:

Trustworthiness Expectations
Additional Information Expected Validity

The granularity oftrustworthiness expectations isflexible and depends on thebusiness provider’srequirements

The Trustworthiness Profile
leverages cryptographic
mechanisms to ensure integrityof the exchanged information

Trustworthiness Capabilities
Supplier
SelfConformance

3rd party

Proof/ Evidence

Proof Expiry Date

3rd-Party Assessement

Upload/Attach

DD.MM.YYYY

Self-Assessed

3rd-Party Assessement

Upload/Attach

DD.MM.YYYY

Conform:

Self-Assessed

3rd-Party Assessement

Upload/Attach

DD.MM.YYYY

Upload/Attach

Conform:

Self-Assessed

3rd-Party Assessement

Upload/Attach

DD.MM.YYYY

Upload/Attach

Conform:

Self-Assessed

3rd-Party Assessement

Upload/Attach

DD.MM.YYYY

Upload/Attach

Conform:

Self-Assessed

3rd-Party Assessement

Upload/Attach

DD.MM.YYYY

Upload/Attach

Conform:

Self-Assessed

3rd-Party Assessement

Upload/Attach

DD.MM.YYYY

Upload/Attach

Conform:

Self-Assessed

3rd-Party Assessement

Upload/Attach

DD.MM.YYYY

Upload/Attach

Conform:

Self-Assessed

3rd-Party Assessement

Upload/Attach

DD.MM.YYYY

ISO/IEC 62443-4-2

Upload/Attach

Conform:

Self-Assessment

ISO 27001

Upload/Attach

Conform:

NIST SP 800

Upload/Attach

Common Criteria

PSS Supplier Questionnaire

Reference Request-for-work

Digital Signature

Time Stamp

Digital Certificate (If required)

Reference TW Expectations

Quote/Bid Reference

Digital Signature

Additional Information

Time Stamp

Digital Certificate (If required)9Next Steps• TECEP Demonstrator• Machine-to-machine secure communication aspects• Automated procedures for the development and evaluation of theTrustworthiness Profile• Digitalization of machine-readable Security Certification Certificates10Plattform Industrie 4.0

Aliza Maftun

Thank you very much.

aliza.maftun@siemens.com
Tel.: +49 (152) 03315778

11