From Trustworthiness Profile Towards a“Framework for Chain-of-Trust”
Aliza Maftun
German Platform Industry 4.0
Siemens AGIntroduction
Plattform Industrie 4.0, Germany and Robot Revolution Initiative, Japan had been collaborating since 2017 on topics
concerning security of Industrial IoT (IIoT) and Industry 4.0 use cases.
The white paper introducesa Trustworthiness
Expectations andCapabilities Exchange
Protocol” (TECEP) as atechnical solution to be used
for trustworthinessnegotiation and exchange
between participating peers.

https://www.plattformi40.de/PI40/Redaktion/EN/Downloads/Publikation/IIoT_Value_Chain_Security.html

2Generic Supply Chain Scenario“Trustworthiness”?

Supplier(s)Retailer(s)/ Distributor(s)Manufacturer(s)/ Integrator(s)Retailer(s)/ Distributor(s)Operator(s)/ Customer(s)Hardware

SoftwareServices

Operational Technology

Certification/
Regulatory
Authorities
Upstream

Information Technology

Certification/
Regulatory
Authorities
Downstream

Legend:Physical and/orDigital
Attacker

DigitalTrustworthiness of Supply Chains for Industry 4.0
In the context of our work, the definition of the term ‘trustworthiness’ proposed by the ISO/IEC JTC1/WG13
has been adapted as:“For supply/value chain security, the term ‘Trustworthiness’ corresponds to thestakeholder’s ability to meet the expectations of the potential contract partner in a verifiableway”.
Note 1: Depending on the use case and on the specific product, different characteristics would apply to fulfil stakeholder’sexpectations. These characteristics may include authenticity, integrity, resilience, availability, confidentiality, privacy,safety, accountability, usability, environmental properties (CO2 footprint), compliance to social regulations…
Note 2: Trustworthiness is an attribute that can be applied to services, products, technology, data and information as wellas, in the context of governance, to organizations.
Note 3: Products and components are considered and the ability to protect products and components regarding integrity
and authenticity along the supply chain.
Note 4: Product properties must include considerations for the intended use/intended operational environment.
4

“Chain of Trust” is needed
There exist many security approaches, which can be used for supply chains, e.g.:
ISO/IEC 28000, ISO 2700x, IEC 62443, ISO 15408, ISO TC292 “Anti-counterfeiting”,….
However, there does not exist a standard suite or a framework yet:•which establishes & measures Trustworthiness of security properties along the supply chain•

which includes interoperability
PXXXXN•

which provides assurance for several nodes of the supply chain•

which supports automated processing

PXXXXSEPXXXXN

Trustworthiness profile serves as the basic building block for the chain of trust,

PXXXXZEE

PXXXXSCC
1, 2, ..NEC
1, 2, ..NC
1, 2, ..NC

“Chain of Trust”

to provide trustworthiness information at any node along the supply chain.
5

Structured Approach to Establish Trustworthiness

TIP
TIP
Supplier(s)TIPRetailer(s)/ Distributor(s)

TIP

TIP

Manufacturer(s)/ Integrator(s)TIP

Retailer(s)/ Distributor(s)

TIP

TIP

TIP

Operator(s)/ Customer(s)TIP
Hardware

SoftwareServices

Operational Technology

TIP
TIP

TIP
Regulatory
Authority

TIP
Information Technology

Regulatory
Authority

TIP
Legend:Upstream

Downstream

Physical and/or
DigitalDigitalTIP Trust Interaction Points
Trust Domains

Ingredients for Trustworthiness Negotiations at Trust Interaction Points
Identities …
• of organizations, such as
NTA, etc.
• of employees, such asusernames, email addresses,
PKI certificates, etc.
• of processes, such as theunique process ID assignedby the operating systems,etc.

Standards andFrameworks

Certificates• Identity Authenticating
Certificates such as X.509 PKI,eIDAS, DIDs, etc.
• “Security CertificationCertificates”, such as
ISO 27001 certificates, IEC
62443 certificates, ISO/IEC
15408 certificates, etc.
• …

••
•
•
•
•
•
•

IEC 62443-x-x
ISO 27001
METI CPSF
NIST CSF
ISO 21434
TISAX
ISO/IEC 15408-x
ISO TC 292 Standards, suchas ISO 22384, etc.
• …

• of products and components,
such as barcodes, etc.
7

Trustworthiness Profile
A standardized containerthat can be realized
irrespective of the basecommunication technology.

Trustworthiness Profile
To be filled by the Buyer

To be filled by the SupplierSupplier s Information

Buyer s Information

Contact Partner:*Contact Partner s Unique Identifier:Contact Information:
Legal Entity Name:*Legal Entity Unique Identifier:*Unique Identifier Scheme: (e.g., link to LEI code repo, VATIN by DUNS, NTA by TSE, etc.)
Country:
Additional Information:

Contact Partner:*Contact Partner s Unique Identifier:Contact Information:
Legal Entity Name:*Legal Entity Unique Identifier:*Unique Identifier Scheme: (e.g., link to LEI code repo, VATIN by DUNS, NTA by TSE, etc.)
Country:
Additional Information:

Trustworthiness Expectations

The granularity oftrustworthinessexpectations is flexible anddepends on the businessprovider’s requirements.
The Trustworthiness Profile
leverages cryptographic
mechanisms to ensure
integrity of the exchanged
information.

Additional Information Expected Validity

Trustworthiness Capabilities
Supplier
SelfConformance

3rd party

Proof/ Evidence

Proof Expiry Date

3rd-Party Assessement

Upload/Attach

DD.MM.YYYY

Self-Assessed

3rd-Party Assessement

Upload/Attach

DD.MM.YYYY

Conform:

Self-Assessed

3rd-Party Assessement

Upload/Attach

DD.MM.YYYY

Upload/Attach

Conform:

Self-Assessed

3rd-Party Assessement

Upload/Attach

DD.MM.YYYY

Upload/Attach

Conform:

Self-Assessed

3rd-Party Assessement

Upload/Attach

DD.MM.YYYY

Upload/Attach

Conform:

Self-Assessed

3rd-Party Assessement

Upload/Attach

DD.MM.YYYY

Upload/Attach

Conform:

Self-Assessed

3rd-Party Assessement

Upload/Attach

DD.MM.YYYY

Upload/Attach

Conform:

Self-Assessed

3rd-Party Assessement

Upload/Attach

DD.MM.YYYY

Upload/Attach

Conform:

Self-Assessed

3rd-Party Assessement

Upload/Attach

DD.MM.YYYY

ISO/IEC 62443-4-2

Upload/Attach

Conform:

Self-Assessment

ISO 27001

Upload/Attach

Conform:

NIST SP 800

Upload/Attach

Common Criteria

PSS Supplier Questionnaire

Reference Request-for-work

Digital Signature

Time Stamp

Digital Certificate (If required)

Reference TW Expectations

Quote/Bid Reference

Digital Signature

Additional Information

Time Stamp

Digital Certificate (If required)8

Trustworthiness Profile Extension
Trustworthiness Profile
To be filled by the Buyer

To be filled by the SupplierSupplier s Information

Buyer s Information
Contact Partner:*Contact Partner s Unique Identifier:Contact Partner:*Contact Partner s Unique Identifier:Contact Information:
Legal Entity Name:*Legal Entity Unique Identifier:*Unique Identifier Scheme: (e.g., link to LEI code repo, VATIN by DUNS, NTA by TSE, etc.)
Country:
Additional Information:

Contact Information:
Legal Entity Name:*Legal Entity Unique Identifier:*Unique Identifier Scheme: (e.g., link to LEI code repo, VATIN by DUNS, NTA by TSE, etc.)
Country:
Additional Information:

Trustworthiness Expectations

Trustworthiness Capabilities

Additional Information Expected ValiditySupplier
SelfConformance

3rd party

Upload/AttachISO/IEC 62443-4-2

Please confirm if your supplier(s) complies to the above listed expectation

Conform:
Yes

No

Please confirm if your supplier(s) complies to the above listed expectation

PSS Supplier Questionnaire

Conform:

Yes

No

Conform:
Yes

No

Please confirm if your supplier(s) complies to the above listed expectation

Conform:
Yes

No

Reference Request-for-work

Digital Signature

Digital Certificate (If required)Self-Assessed

Yes

Self-Assessed

Reference TW Expectations

No

3rd-Party Assessement
Yes

No

3rd-Party AssessementSupplier(s) Conform:

Time StampNo

3rd-Party Assessement

Supplier(s) Conform:

Upload/Attach

Common Criteria

Self-Assessed

Yes

Supplier(s) Conform:

Upload/Attach

Please confirm if your supplier(s) complies to the above listed expectation

3rd-Party Assessement

Supplier(s) Conform:

Upload/Attach

NIST SP 800

Self-Assessment

Yes

No

Proof/
Proof/ Evidence

Proof Expiry Date

Upload/Attach

DD.MM.YYYY

Upload/Attach

DD.MM.YYYY

Upload/Attach

DD.MM.YYYY

Upload/Attach

DD.MM.YYYY

Upload/Attach

DD.MM.YYYY

Upload/Attach

DD.MM.YYYY

Upload/Attach

DD.MM.YYYY

Upload/Attach

DD.MM.YYYY

Quote/Bid Reference

Digital Signature

Additional Information

Time Stamp

Digital Certificate (If required)9Next Steps•

Standardization of the Framework for Trustworthiness, including the Trustworthiness Profile.

•

Suitable secure identities/identifiers and corresponding infrastructure to realize the Chain of Trust.

•Mechanism(s) to bind SCCs to the corresponding real world entity and its operational environment.

•Identify and evaluate technologies to realize the Chain of Trust along supply/value chains.

•Communicate and discuss the results.

Plattform Industrie 4.0

Thank youvery much

Aliza Maftun
aliza.maftun@siemens.com

11