An Approach for Data Security in the Era ofIndustry 4.0
keeping data safe

Masao Ito
NIL Software Corp.
email: nil@nil.co.jp
7/Sep/2017

Introduction▪ In the Industry 4.0 era, there is the difference between thephysical and logical view of the factory. For example, a machine
owned by a company, but it might be controlled by anothercompany.
▪ As for safety and security, it might be desirable to analyse thesystem (of systems) by a single approach. Focusing on the earlyphase of system development, we try to conider the possibilityof an approach.

© 2017 NIL software corp.

2

Industry 3.0 to 4.0
Company B

Company A
ProductCompany C

IT-Security in Industrie 4.0

MachineHuman
Data Processes

https://www.plattform-i40.de/I40/Redaktion/EN/Downloads/Publikation/
it-security-in-i40.html

Industry 3.0

Industry 3.0
Company B

Company A

MachineMachineProdukt
Produkt

Components

Components

Product
Administrative
shell

Industry 4.0

Components

CACA
TrustCenter

Company C

Data

Human
rwaltungs VeVe
rwaltungsschale
Administrative
Processes
schaleshell

CA

Product
Industry 3.0© 2017 NIL software corp.

StrongerIndustry 4.0

Industry 4.0 Familiar3

It says,
The essential prerequisite for a successful
implementation of Industrie 4.0 is a secure andtrustworthy treatment of data and a reliable
protection of inter-company communicationfrom external attacks.

© 2017 NIL software corp.

4Industry 4.0

intra-factories

no air gaps?

inter-machine
intra-machineinter-company

intra-machinecompany B

intra-company
inter-factory

intra-factoryinter-machine
intra-machineinter-machine

intra-machine

intra-machinecompany A© 2017 NIL software corp.

intra-factory

intra-machine5Comparison of Standards @ concpt phase

Security
Safety© 2017 NIL software corp.

ISA/IEC 62443
ISO 26262

6

Comparison of security and safety standards▪ Security▪ ISA/IEC 62443 (ISA99) is the comprehensive standards for security of theindustrial automation and control system (IACS). It aims to prevent:▪

endangerment of public or employee safety▪

loss of public confidence▪

violation of regulatory requirements▪

loss of proprietary or confidential information▪

economic loss▪

impact on national security▪ Safety▪ ISO 26262▪ ISO 26262 is intended to be applied to safety-related systems that include

one or more electrical and/or electronic (E/E) systems and that are
installed in series production passenger cars with a maximum gross vehicle
mass up to 3 500 kg.

© 2017 NIL software corp.

7

ISA/IEC 62443 uses zone & conduit model

Zone

ZoneConduit© 2017 NIL software corp.

8Zone and Conduit of IACS

▪ Data Centerinter-factoryor -company

Enterprise Zone

Information Zone

▪ Network
intra-factory

SCADA
Server▪ Gateway
intra-factoryinter-machine▪ End-Point

SCADA
ServerPrimary Control Center

RTU/
PLC

RTU/
PLC

IO

IO

Backup Control Center・・・・

RTU/
PLC

RTU/PLCIO

IO

intra-machine
SCADA: Supervisory Control And Data Acquisition
RTU: Remote Terminal Unit
PLC: Programmable Logic Controller© 2017 NIL software corp.

IO

IO

・・・

Control Zone

IO

IO

・・・

Control Zone

9ISA/IEC 62443 Standards
Reference

IEC Reference

Title

ISA-TR62443-0-3

N/A

Gap assessment of ANSI/ISA-99.02.01-2009

ISA-62443-1-1

IEC/TS 62443-1-1

Models and concepts

ISA-TR62443-1-2

IEC/TR 62443-1-2

Master glossary of terms and abbreviations

ISA-62443-1-3

IEC 62443-1-3

System security compliance metrics

ISA-TR62443-1-4

IEC/TR 62443-1-4

Security life cycle and use cases

ISA-62443-2-1

IEC 62443-2-1

Requirements for an IACS security management
systemISA-TR62443-2-2

IEC/TR 62443-2-2

Implementation guidance for an IACS securitymanagement system

ISA-TR62443-2-3

IEC/TR 62443-2-3

Patch management in the IACS environment

ISA-62443-2-4

IEC 62443-2-4

Requirements for IACS solution suppliers

ISA-TR62443-3-1

IEC/TR 62443-3-1

Security technologies for IACS

ISA-62443-3-2

IEC 62443-3-2

Security risk assessment and system design

ISA-62443-3-3

IEC 62443-3-3

System security requirements and security levels

ISA-62443-4-1

IEC 62443-4-1

Product development requirements

ISA-62443-4-2

IEC 62443-4-2

Technical security requirements for IACS components© 2017 NIL software corp.

10The Early Stage of Process
Table 1. Comparisson of the early stage between IEC 62443 with ISO 26262

IEC 62443-1-1
Concept Phase (Identification step,Concept step)

ISO 26262 Part 3 (Concept Phase)
3-5: Item Definition
3-6: Initiation of the Safety Lifecyle

Analysis Phase (Definition step)

3-7: Hazard Analysis and Risk
Assessment
3-8: Functional Safety Concept• Continue developing the security program• Establish security functional requirements for industrial automation and control systems and equipment,
production systems, information systems, and personnel• Perform vulnerability assessment of facilities and associated services against the list of potential threats• Discover and determine legal requirements for industrial automation and control systems• Perform a risk analysis of potential vulnerabilities and threats• Categorize risks, potential impacts to the enterprise, and potential mitigations• Segment security work into controllable tasks and modules for development of functional designs• Establish network functional deﬁnitions for security portions of industrial automation and controlsystems© 2017 NIL software corp.

11Security Level
3.2.107 security level
level corresponding to the required
eﬀectiveness of countermeasures and inherent
security properties of devices and systems fora zone or conduit based on assessment of risk
for the zone or conduit [13].
Security Level123© 2017 NIL software corp.

QualitativeDescription
LOWMediumHigh• Target SLUser• Capability SLUser and Vendor• Achived SLUser

12IEC 62443 Risk analysis requirements
The target SL(Security Level) does NOT identiﬁed here
4.2.2.1

Develop a business rational

4.2.3.1

Select a risk assessment methodology

4.2.3.2

Provide risk asssessment background information

4.2.3.3

Conduct a high-level risk assessment

4.2.3.4

Identify the industrial automation and control systems

4.2.3.5

Develop simple network diagrams

4.2.3.6

Prioritize sytems

4.2.3.7

Perform a detailed vulnerability assessment

4.2.3.8

Identify a detailed risk assessment methodology

4.2.3.9

Conduct a detailed risk assessment

4.2.3.10

Identify the reassessment frequency and triggering criteria

4.2.3.11

Integrate physical, HSE and cyber security risk assessment reuslts

4.2.3.12

Conduct risk assessments throughout the lifecycle of the IACS

4.2.3.13

Document the risk assessment

4.2.3.14

Maintain vulnerability assessment records© 2017 NIL software corp.

high-levelrisk, likelyhood

detailed13

Risk Analysis

Security Level (SL) canbe determined after
established the zoneand conduit model

ISA/IEC 62334-2-1 p.48
© 2017 NIL software corp.

14

Security Level Lifecyle Model: Assess Phase

ISA/IEC 62334-2-1 p.122© 2017 NIL software corp.

15

ISA/IEC 62443 vs. ISO 2626 standard▪ The both standards define required (security/safety) level in theearly stage: target SL (62443), ASIL (26262).
▪ But, in 26262, we give the ASIL only to the item (abstractsystem), and later apply them to parts (c.f. ASIL decomposition).
▪ In 62443, we give the target SL to each zone (or conduit) after

designing the zone-conduit model.

© 2017 NIL software corp.

16Detection of Anomality of Data

© 2017 NIL software corp.

17Catch the threats in the conduit▪

Virus entered and it
emitted the wrong
information
Enterprise Zone▪

Information Zone

The access control wasviolated because of poor
mechanism
SCADAServer▪

Infected USB memory
was inserted

SCADA: Supervisory Control And Data Acquisition
RTU: Remote Terminal Unit
PLC: Programmable Logic Controller© 2017 NIL software corp.

SCADA
ServerPrimary Control Center Zone

RTU/
PLC

RTU/
PLC

IO

IO

IO

IO・・・・

Backup Control Center

RTU/
PLC

RTU/
PLC

IO

IOIO・・・・・・

Control Zone

Control Zone

IO

18

W32.Stuxnet
It attacks systems (centrifuge separator) that spin
between 807hz to 1210hz, once it found them, it
manipulated the operation of the motors bychanging their rotational speed.
it modified the frequency anywhere from 1410hz
to 2hz, all while sending false data back to theoperators.

© 2017 NIL software corp.

19

Verification function
Conduit_a

Conduit: Flow data

Zone: Saved data

ValidityOfFlowData(Direction, Contents,Timing)
Direction:

Zone_A

toZone_A / fromZone_A

ValidityOfStoredData(Action, Contents,Timing)
Action: Create/Read/Update/Delete tothe Data

Possibility of security violation
It returns false;
The contents and the timing of data isvalid, but the data wrongly go out
throuth the conduit.
© 2017 NIL software corp.

It returns false;
The data was updated timely, but thecontents of it is wrong.
20Detection in ISO 26262▪ In 26262, fault detection is important, such as Fault TolerantInterval Time (FTTI).
The safety goal can include features such as the fault tolerant time interval,
or physical characteristics (e.g. a maximum level of unwanted steering-wheel
torque, maximum level of unwanted acceleration) if they were relevant to the
ASIL determination. (ISO 26262 3-7.4.4.6)

Secure State

Clean

Detected(Transition To Safe State)(Safe)
Attacking(Fault)© 2017 NIL software corp.

21

FTTI & Emergency Operation Interval

Fault

Fault Detection

Transitioned to Safe State

NormalOperation

Possible Hazzard(Safe State)
TimeT <= Diagnostic Test
Fault Reaction TimeInterval
Emergency Operation Interval
Fault Torelant Time Interval

FTTI

Fault reaction time and fault tolerant time interval (ISO26262-1 Fig.4)© 2017 NIL software corp.

22

ATTI: Attack Torelant Time Interval

AttackingAttack Detection

Transition to Secure State

NormalOperation

Possible Hazzard(Secure State)Time
T <= Diagnostic Test
Interval

Fault Reaction Time

Emergency Operation Interval

Attack Torelant Time Interval© 2017 NIL software corp.

23

Generic mechanism to calculate FTTI
• To calculate FTTI, we need the various flow paths
Reﬁned Controller

OutputaController
Input

Input
Checker

OutputChecker

Runtime Checker（Fault Detection)(Transit to Safe State)© 2017 NIL software corp.

Error

24

Generic mechanism to calculate ATTI
• Detection mechanism and calculation of ATTI
Reﬁned Repository

OutputData Repository
Input

Input
Checker

OutputChecker

Runtime Checker

Error（Attack Detection)(Transit to Secure State)© 2017 NIL software corp.

25

Conclusion▪ In industry 4.0 era, the network of a company will be opened toother company to communicate each other. So, we have to focus on
the security and data that is transferred between companies andstored in those companies.

▪ The IACS uses the zone and conduit model to keep them secure. Thezone is in a layer according to its security level. The conduit is thecommunication channel between the zones. We have to think thesecurity of zone (and the data in it) and conduit.

▪ As for concept model, there are some differences between securitystandard (IEC 62443) and the safety standard (ISO 26262). In ISO
26262, we give the ASIL to an item, that is the abstraction of thesystem. On the other hand, in IEC 62443, we just assess therequirement and context in the context phase. In the next step, wegive the SL to each zone (and conduit). We need the zones andconduits after first design.

© 2017 NIL software corp.

26Conclusion▪ The zone and conduit model has the rationale. However, if

anything breaks it, it is hard to detect the intruder and to protect
a system. In this presentation, we provide the model for
detection based on the ISO 26262 definition and our approachfor FTTI calculation. The ATTI is the attack tolerant time interval,
and to assure this ATTI we can use the mechanism for attack
detection.

© 2017 NIL software corp.

27