Toward Human-centric Industries“Connected Industries”
New vision for the future of Japanese industries

The Germany-Japan Agree
Trustworthiness Communication Rulefor Securing Supply Chains of Industrial IoT

27th May 2021
Robot Revolution & Industrial IoT Initiative (RRI)
Junya Fujita (R&D Group, Hitachi, ltd.) 

d!"!#$%&'()*+,-$.&/&-$.01&23-*&4$5$64738-)*92$6&:$64*-*9-*10;$<22$.*+,-8$.080)107=

Toward Human-centric Industries“Connected Industries”
New vision for the future of Japanese industries

Agend
1. Introductio

2. The Germany-Japan Agreed Trustworthiness Communication Rule

3. Conclusion and Next Step 

na!"!#$%&'()*+,-$.&/&-$.01&23-*&4$5$64738-)*92$6&:$64*-*9-*10;$<22$.*+,-8$.080)107=1

Toward Human-centric Industries“Connected Industries”
New vision for the future of Japanese industries

Agend
1. Introductio

2. The Germany-Japan Agreed Trustworthiness Communication Rule

3. Conclusion and Next Step 

na!"!#$%&'()*+,-$.&/&-$.01&23-*&4$5$64738-)*92$6&:$64*-*9-*10;$<22$.*+,-8$.080)107=1

Toward Human-centric Industries

About RRI & Connected Industries“Connected Industries”
New vision for the future of Japanese industries– The Robot Revolution and Industrial IoT Initiative (RRI) is a private-led organization
platform to promote "Robot Revolution” based on Japanese government’s strategy– Around 500 organizations in Japan are members of RRI– RRI promotes “Connected-Industries” in industrial fields such as manufacturing, logistics,facilities, constructions and so on

Connected Industries(A strategic concept announced by METI, Japan)2.

. 

!"!#$%&'()*+,-$.&/&-$.01&23-*&4$5$64738-)*92$6&:$64*-*9-*10;$<22$.*+,-8$.080)107=

Toward Human-centric Industries

Germany-Japan Collaboration in Industrial Security“Connected Industries”
New vision for the future of Japanese industries– Japan(RRI) and Germany (PI4.0: Plattform Industrie 4.0) concluded an agreement onenhancement of collaboration（In April 2016）– “Industrial Security” is one of the areas to be focusedcollaboration inindustrial security!"!#$%&'()*+,-$.&/&-$.01&23-*&4$5$64738-)*92$6&:$64*-*9-*10;$<22$.*+,-8$.080)107=3

Toward Human-centric Industries

Our Past Activities“Connected Industries”
New vision for the future of Japanese industries⁃ The goal of our activities are➢ To identify new security requirements for Industrie 4.0＆ Connected Industries an➢ To incorporate trustworthiness in upcoming interconnected economie⁃ PI4.0(Germany) & RRI(Japan) published a common position paper:“Facilitating International Cooperation for Secure Industrial Internet of Things/ Industrie 4.0”
(The latest update is released in April 2019https://www.jmfrri.gr.jp/english/document/library/1107.html⁃ PI4.0 and RRI had discussed the role of trustworthiness intensively in 2019 and released awhitepaper “IIoT Value Chain Security –The role of Trustworthiness” in September 2020

Today, some topics that PI4.0/RRI had
discussed are introduced(DE/EN) https://www.plattform-i40.de/PI40/Redaktion/DE/Downloads/Publikation/IIoT_Value_Chain_Security.html(JP) https://www.jmfrri.gr.jp/document/library/1652.html

4ds ):!"!#$%&'()*+,-$.&/&-$.01&23-*&4$5$64738-)*92$6&:$64*-*9-*10;$<22$.*+,-8$.080)107=

Toward Human-centric Industries“Connected Industries”
New vision for the future of Japanese industries

Agend
1. Introductio

2. The Germany-Japan Agreed Trustworthiness Communication Rule

3. Conclusion and Next Step na!"!#$%&'()*+,-$.&/&-$.01&23-*&4$5$64738-)*92$6&:$64*-*9-*10;$<22$.*+,-8$.080)107=1

Toward Human-centric Industries

Background - Global Value Chain and Security Risks“Connected Industries”
New vision for the future of Japanese industries⁃ Global value chains accelerated by information and communication technologies requirecomprehensive “trustworthiness architectures” covering all entities, regardless of theirgeographical locatio⁃ Product manufacturers need to1) develop products that satisfy rapidly changing customer need2) collaborate with other suppliers to develop their products securel3) find appropriate suppliers timely through the Internet

Reference: Whitepaper “IIOT Value Chain Security –The Role of Trustworthiness
ys:n!"!#$%&'()*+,-$.&/&-$.01&23-*&4$5$64738-)*92$6&:$64*-*9-*10;$<22$.*+,-8$.080)107=6

The definition of “Trustworthiness” in the discussion“Connected Industries”
New vision for the future of Japanese industries– In the context of our project, the definition of the term “trustworthiness” proposed by theISO/IEC JTC1/WG13 has been adapted as:
For supply value chain security and risk management, the term
“Trustworthiness” corresponds to the supplier’s ability to meet theexpectations of the potential contract partner in a verifiable way– “Trustworthiness” is depended on use-cases in supply chains and products, different
characteristics would be considered to fulfill stakeholder’s expectations
Ref: the whitepaper “IIOT Value Chain Security –The role of Trustworthiness” 202.

0!"!#$%&'()*+,-$.&/&-$.01&23-*&4$5$64738-)*92$6&:$64*-*9-*10;$<22$.*+,-8$.080)107=  

Toward Human-centric Industries

7Toward Human-centric Industries

Online Procurement and Digital Agreement“Connected Industries”
New vision for the future of Japanese industries⁃ To achieve global value chains, online procurement & digital agreement are importan⁃ Matters related to trustworthiness:

Online procurement- Authenticity of partie- Security level of their product- Security level of their security activities
Exchange “Trustworthiness profile”

Digital agreemen- Authenticity of the organization as a legal
entity represented by a legal entity I- Authenticity of the signer as a responsible
natural person represented by a naturalperson ID

Today’s focus

8tDsst!"!#$%&'()*+,-$.&/&-$.01&23-*&4$5$64738-)*92$6&:$64*-*9-*10;$<22$.*+,-8$.080)107=

Toward Human-centric Industries

Exchange Trustworthiness Informationin online procurement“Connected Industries”
New vision for the future of Japanese industries⁃ In online procurement process, organizations exchange machine-readable“TWP(Trustworthiness Profile)” each other before contractin⁃ RRI and PI4.0 had discussed to plan the TWP in a demonstrator, which provides adigitalized trustworthy relationships between buyers and suppliers in global value chains
Global Truste
Security Infrastructure
Bidders
Security questionnaires toselect suppliers

Buye(Product manufacturer)

Answer forquestionnaires✓ Evaluate “Trustworthiness” basedon answer & evidences

Contract

Supplier A

Supplier B

Trustworthinessleve:High

Trustworthinessleve:Low

Supplier A

Purchase Order

Selec“the most trustworthy” suppliergdrtll!"!#$%&'()*+,-$.&/&-$.01&23-*&4$5$64738-)*92$6&:$64*-*9-*10;$<22$.*+,-8$.080)107=8

Toward Human-centric Industries

Our discussions topics for TWP“Connected Industries”
New vision for the future of Japanese industries⁃ To establish the security requirements(questionnaire) for TWP, referred major securitystandard(Examples security standard➢ ISO 27001 (Information Security Management System➢ IEC 62443 (Security Requirements for Industrial Automation Systems➢ VDA-ISA (Criteria for Supply Chain Security in automotive industry➢ NIST CSF and METI CPSF (Risk Management Processes for Organizations

Acronym
ISO: International Organization for Standardizatio
IEC: International Electrotechnical Commissio
VDA: Verband der Automobilindustrie, German
ISA: Information Security Assessmen
NIST: National Institute of Standards and Technology, US
CPF: Cybersecurity Framewor
METI Ministry of Economy, Trade and Industry, Japa
CPSF: Cyber-Physical Security Framework⁃ On the German (PI4.0) side, planned the design of an exchange protocol for TW(TECEP: Trustworthiness Expectations and Capabilities Exchange Protocol⁃ On the Japanese (RRI) side, planned a questionnaire for suppliers➢ The questionnaire is based on security standards and requirements that have been achieved in Japaneseindustrie➢ The questionnaire consists of 25 items to evaluate security controls in operation, management processes andorganizatio➢ The questionnaire provides evidences and criteria of maturity levels on each requirement
JP https://www.jmfrri.gr.jp/document/library/1890.html
EN https://www.jmfrri.gr.jp/english/document/library/1892.html8P)))))

An)

nyntknsss!"!#$%&'()*+,-$.&/&-$.01&23-*&4$5$64738-)*92$6&:$64*-*9-*10;$<22$.*+,-8$.080)107=

Toward Human-centric IndustriesAn Example of Items in Questionnaire“Connected Industries”
New vision for the future of Japanese industries

Category

Governance

Security requirement

Develop and announce security policies, define roles and responsibilities for security across the organization andother relevant parties (Suppliers) .

History of security policy development and approval, and approval of revisions to the security policy.
Describe the security roles and responsibilities of the organization and other relevant organizations(e.g., contractors), and any arrangements for security with contractors in the security policy.

evidenceThe security officer of the organization has developed (documented) a security policy.

１Example:Answer

Maturitylevel２□Implemented □Planned to be implemented □Not applicable

The organization's Chief information security officer has approved and implemented the security policy.
The organization manages and implements the approved documents.
□Implemented □Planned to be implemented □Not applicable３

The organization's security officer and chief information security officer regularly review, update, andmaintain security policies.
□Implemented □Planned to be implemented □Not applicable!"!#$%&'()*+,-$.&/&-$.01&23-*&4$5$64738-)*92$6&:$64*-*9-*10;$<22$.*+,-8$.080)107=8

Toward Human-centric Industries

Use case of the questionnaire for TWP Evaluation“Connected Industries”
New vision for the future of Japanese industries

Supplier
Answer from supplier=Supplier’s capability of TWP

Buyer
Expected level for TWP = requirement

Supplier A

Selected supplier
Security
Requirements

Supplier B
level１ level２ level３
Maturity level

Supplier C

Supplier C !"!#$%&'()*+,-$.&/&-$.01&23-*&4$5$64738-)*92$6&:$64*-*9-*10;$<22$.*+,-8$.080)107=8

Toward Human-centric Industries

Collaboration activities between RRI and PI4.0“Connected Industries”
New vision for the future of Japanese industries⁃ On German side, a R&D project that develops TWP demonstrator has been runnin(Ref.) https://legaltestbed.org/en/trust-demonstrator/⁃ The questionnaire would be incorporated into the demonstrator

RRI’s questionnaires for
suppliers would beincorporated

Reference: Whitepaper “IIoT Value Chain Security –The role of Trustworthiness.

8g!"!#$%&'()*+,-$.&/&-$.01&23-*&4$5$64738-)*92$6&:$64*-*9-*10;$<22$.*+,-8$.080)107=

Toward Human-centric Industries“Connected Industries”
New vision for the future of Japanese industries

Agend
1. Introductio

2. The Germany-Japan Agreed Trustworthiness Communication Rule

3. Conclusion and Next Step 

na!"!#$%&'()*+,-$.&/&-$.01&23-*&4$5$64738-)*92$6&:$64*-*9-*10;$<22$.*+,-8$.080)107=1

Toward Human-centric Industries

Conclusion and Next Step

“Connected Industries”
New vision for the future of Japanese industries⁃ Japan(RRI) and Germany (PI4.0) are collaborating to establish a trustworthinessarchitecture for the next-generation industrie⁃ RRI had planed a security questionnaires for suppliers to evaluate a trustworthiness profile(TWP) through the collaboratio⁃ RRI expects the questionnaire and the answer for the questionnaire would bestandardized, would be used digitally for online contract⁃ RRI and PI4.0 continue to discuss security issues in global value chain
and continue to announce the result to the world continuously

19sssn!"!#$%&'()*+,-$.&/&-$.01&23-*&4$5$64738-)*92$6&:$64*-*9-*10;$<22$.*+,-8$.080)107=

Toward Human-centric Industries“Connected Industries”
New vision for the future of Japanese industries

Thank youjunya.fujita.so@hitachi.com!

!"!#$%&'()*+,-$.&/&-$.01&23-*&4$5$64738-)*92$6&:$64*-*9-*10;$<22$.*+,-8$.080)107=