ZEISS Predictive Service
Technology information for our Remote Service ProgramTechnical NoteZEISS Predictive Service
Technology information for our Remote Service Program
Author:		

Dr. Christian Schwindling, Marcus Jacob
Carl Zeiss Microscopy GmbH, Germany

Date:		

January 2022

This document describes the architecture and security features of ZEISS Predictive Service.
It is intended to help IT decision-makers understand how ZEISS Predictive Service operates within your environment and how it meets your technical security requirements. It is also intended to address questions about key
issues such as communication through firewalls and network security.

Connectivity

Figure 1 Connectivity

The central part of the network connectivity is the so-called

stored using strong AES 256-bit encryption in the installation

Agent, a small software package installed on the microscope’s

directory of ZEISS Predictive Service agent.

control PC. It is configured to run as a Windows service withTypically there is no need to modify firewall settings,

local system privileges as “ZEISS Predictive Service Agent”.

if outbound HTTPS connections towards predictive-service.
zeiss.com are already permitted.

When running, the ZEISS Predictive Service Agent will try to

The enterprise server predictive-service.zeiss.com is hosted

establish a connection to the ZEISS enterprise server atusing Microsoft Azure Cloud infrastructure, certified andpredictive-service.zeiss.com using the https protocol with TCP

audited according to international standards (e.g. ISO 27001,port 443 and 256-bit TLS (transport layer security) end-to-end

HIPAA, FedRAMP, SOC1, and SOC2).

encryption. This connection is always outbound only.

The application running on enterprise server is based on PTC

This means the communication channel is always

ThingWorx, which includes industry-standard security features

initiated by the agent so that the agent can only receive

like HTTP authentication and authorization, security logging

messages over an established connection. It is important tosub-systems, encrypted storage of all sensitive dataknow that at no time the ZEISS Predictive Service agent will

(login data), support for transport layer security to ensure thatact as a server and open ports for inbound connection,

all data transmitted over the wire is encrypted (TLS 1.2 witheffectively avoiding a typical attack vector. If the local networkAdvanced Encryption Standard (AES) 256 bit).

requires a proxy server, the server address can be configured.

The communication between ZEISS enterprise server andIf a user name and password is required, the password will bethe agent follows the secure WebSocket Standard.

2Technical Note

There will be an initializing phase where the agent establishes

Connectivity Summary

a secure connection to the enterprise server over the HTTPS.

•Windows service ZeissPredictiveServiceAgent.exe

Over that connection, a WebSocket upgrade is done to allow•

Only outbound HTTPS, 256-bit TLS/SSL secured

bidirectional communication between agents and ZEISS

connection on port 443

enterprise server. After the initializing phase, the agent pushes•

No open ports for inbound connections

the specified data values that are important to monitor the•Proxy server support

instrument health data or to generate customer reports.

•Typically no changes to firewall settings

Data values could be for example operating hours,•Microsoft Azure cloud infrastructure certified andcomponent level voltages, or connection status. Also, the log

audited according to international standards

files will be transferred over the same established connection.

(ISO 27001, HIPAA, FedRAMP, SOC1 and SOC2)

Every data transfer requires an established communication
channel, which is always initiated by the agent. Consequently,
the enterprise server can only request data over an establishedsecure connection. Once the connection has been establishedit will be maintained until a connection loss requires
establishing a new connection.

Condition Monitoring
This section describes the use case Condition Monitoring,system failures quickly without the need of collecting thewhich is based on the connectivity model described above.

respective log files manually. Before data upload, all potentially

Condition Monitoring is the systematic retrieval of relevant

sensitive personal data will get anonymized. Based on ourinstrument health information and its server-based processing.

testing, we expect average network traffic to be less than 2 MB

The goal is to detect deviations in the instrument performance

per day. Log files are typically uploaded once per day.

before they impair the user’s result or even result in

These estimates are highly dependent on system usage.

unplanned downtime. A typical example is the preventiveWhen the agent is first installed, higher than normal network

replacement of a mechanical component which has reachedtraffic is expected while historical data is uploaded.

its maximum movement cycles.

Below you will find a list of the log files with corresponding

Instrument health data can be, for example, operating hours,

storage locations on the customer’s system control PC.

movement cycles of motorized components, component level

On the server, data is stored with a timestamp and checkedvoltages, firmware versions, and error messages.

against predefined rules. Actions, such as the notification ofThe exact scope is device-specific.

a ZEISS service engineer can be triggered.

All relevant data is collected by the system operating software

Trained and authorized ZEISS staff can log on to the enterpriseof the ZEISS microscope and saved to separate log files

server and review the full data set and its history for diagnostic(see table 1). These files can be opened with a text viewer.

purposes. At no time, results from the microscope user forThe log files are continuously monitored by the agent

some processed images are transmitted in this data stream.

software. As new data is stored, the agent parses the log fileand transmits the data items to the enterprise server over theCondition Monitoring Summary

established connection. Information about operating system•and system operation software (e.g. ZEN, SmartSEM) areare transmitted (see table 1).

retrieved through the registry and Windows Management
Instrumentation (WMI). This data can contain an operating
system version, PC serial number, and hard drive utilization.

Only log file data from specific log file storage locations
These files are fully transparent and plain-text readable•No user-specific information or files are included incontinuous monitoring

Besides the parsing, complete log files will also be transferredto the server to help ZEISS support personnel to identify

3Technical Note

Device typeLog file name

Description

PathElectron

EM Server.log

Information about EM Server

C:\ProgramData\Carl Zeiss\SmartSEM\Log\EM Server.log

Log Folder

Includes SmartSEM Logs (GIS, FIB,…) C:\ProgramData\Carl Zeiss\SmartSEM\Log

Snapshot Folder

Includes Capella System Snapshots

C:\ProgramData\Carl Zeiss\Capella\SystemBackups

Log Folder

Data monitoring of EM ServiceCenter Software

C:\ProgramData\Carl Zeiss
Microscopy GmbH\EmServiceCenter\DataMonitoring\External

microscopes
Electronmicroscopes
Electronmicroscopes

Electronmicroscope

Light

D:\EmServiceCenter\DataMonitoring\
External
remote service.log.xml

Already parsed information fromZEN.log.xml and ZENCore.log.xml

C:\ProgramData\Carl Zeiss\Remote
Service\remote service.log.xml

ZEN.log.xml

Information about ZEN software

C:\ProgramData\Carl Zeiss\Logging

ZENCore.log.xml

Information about ZEN coresoftware

C:\ProgramData\Carl Zeiss\Logging

XradiaAppn.log where
n=1,2,….N used in system
software v11.1

Information about Versa systemparameters

C:\Program Files\Carl Zeiss X-ray
Microscopy\Xradia Versa\XX.X.XXXX.
XXXXX\Log Files

X-ray source logs

C:\Program Files\Carl Zeiss X-ray
Microscopy\Xradia Versa\XX.X.XXXX.
XXXXX\logsmicroscopesLight
microscopesLight
microscopes

X-ray
microscopes

X-ray
microscopes

XradiaApp_n.log where
n=1,2,….N used in system
software v12Centre.log
Comms.log
FilStore.log
Getter.log
Healthcheck.log
Serial.log
TCC.log
Tube.log
Vac.logWarm.log

Table 1: Overview of log files

4Technical Note

Optional image upload
You have the possibility to select the optional Image Upload function regarding automated Sample Finder. This option can beselected or unselected during the activation process or afterwards within the Predictive Service settings menu on your system. At
these points the referring General Conditions of this feature can be viewed at any given time.
This automated Sample Finder Image Upload mainly helps ZEISS to improve Machine Learning models to further enhance Sample
Finder functionalities and efficiency.

Installation
After approval of Predictive Service by you and your IT department, there are two options to get your ZEISS microscope
connected. The precondition for both options is that your system is connected to the internet with all necessary security
measures (e.g. antivirus software). Please see also our recommendations for data security.
1. Preinstallation in factory
For selected system types (LSM, Axioscan, etc) the Predictive Service agent software is already preinstalled in our factory.
When you will start your system operation PC for the first time, a pop-up screen of Predictive Service software will appear andwill guide you through the activation process (e.g. terms and conditions acceptance, internet settings).
2. Installation via TeamViewer remote desktop sharing•All necessary information and documents are sent to•

ZEISS and a remote installation session is scheduled.

the TeamViewer session request and remote control

Please clarify also if there are specific proxy settingsneeded and if so, please have these settings available forrequest•

installation•

You will receive an e-mail from ZEISS service with a link toStart the TeamViewer Quick Support software and accept

ZEISS tech support will install ZEISS Predictive ServiceAgent•

download the TeamViewer Quick Support software.

Test, if the connection between the Agent software andthe Enterprise server is established

Please note that this software will not be installed
permanently on your PC
For more security details please check on TeamViewer: https://dl.tvcdn.de/docs/en/TeamViewer-Security-Statement-en.pdf
3. Installation by field service engineer•All necessary information and documents are sent to•

ZEISS and an on-site visit is scheduled.
Please clarify also if there are specific proxy settingsZEISS field service engineer will installZEISS Predictive Service Agent•needed and if so, please have these settings available for

Test if the connection between the Agent software andthe Enterprise server is establishedinstallation

Security relevant Updates
ZEISS may update the Predictive Service Software from time to time to provide the latest functionality and security updates. Theseupdates will be installed automatically unless you explicitly reject the consence of the General Conditions of Predictive Service.
If the consent is rejected Predictive Service will be deactivated at all.

5

Technical Note
Technical facts
Ports

443

Protocols

HTTPS, Secure Websocket

URL of ZEISS server

predictive-service.zeiss.com
www.predictive-service.zeiss.com

IP addresses

52.174.243.245

Certification of Microsoft Azure cloud infrastructure

ISO 27001, HIPAA, FedRAMP, SOC1 and SOC2Connection security

TLS 1.2 with AES 256bit

Supported proxy settings for installation- No authentication- Basic authentication- Digest authentication- NTLM authentication

Available and patched local area network connected toZEISS system PC
Security patched and measures according to your local
IT security standards

RJ 45 connector for LANe.g. installing antivirus software; please see recommendations
for data security policy on ZEISS Microscopy Systems(see references)

Established and working outbound internet connection

Overview of Data Security
This section will give you an overview of data security standards and measures in the context of ZEISS Predictive Service IoT
product.

PTC ThingWorx IoT platform

Testing and validation of data security measures••

Server security (due to IT security reasons, individual
measures will not be listed here)

Continuous (daily) testing due to automated tests ofcustom implemented features•Secure design principles•

Authentication and authorization•Matrix multi-tenancy•

Security logging sub-system

year by trusted and verified external partners. Any findings•

Encrypted storage of all sensitive data

will be fixed.

•Recommended and supported backup strategy•

Protection against common vulnerabilities•

Support for transport layer security•

Additional security featureso Access to the office•File transfer and application tunneling witho Access to the systems

ThingWorx EMS

o Separation of productive- and test-platform••

Evaluation of permissions to access different backend
services of custom implemented features••

Penetration Tests (“Pen Tests”) are executed once every

Continuous updates on Internet-facing systems and coredependencies•

Secure and scalable on-demand centers

Secure development environmento BackupConnectivity security•

Version control•

Manufacturer’s requirements for connected product•

Change control

security•

Acceptance test•

End-customer requirements for connected products•

Secure programming techniques

6Technical Note

Microsoft Azure cloud storage

Testing and validation of data security measures••

Different kinds of testing•

No changes of third-party softwareo Security groupso Permission levels
o Permission states•DDoS protection•

Secure by design•

Credential security•

Live site response•

Service security•

General Data Protection Regulation (GDPR)•

Data residency and sovereignty(Exception: security holes)•Training measures of employees•

Control of outsourced development

EN_43_013_046 | CZ-01/2022 | Design, scope of delivery and technical progress subject to change without notice. | © Carl Zeiss Microscopy GmbH

Access and permission management

References
Recommendations for data security policy on ZEISS Microscopy Systems
AGBs General terms and conditions Predictive Service..............................................................

.........................................................

Martin Fischer						Dr. Christian Schwindling
Head of Global Service & Customer Care		
Head of Remote Service & IT Support
ZEISS Research Microscopy Solutions			
ZEISS Research Microscopy Solutions

Carl Zeiss Microscopy GmbH07745 Jena, Germany
Service and Customer Caremicroscopy@zeiss.com
www.zeiss.com/microscopy

7