Manufacturing Encryption
By: Dave Edstrom
This month we are wrapping up my summer series on manufacturing cyber security by taking a deeper dive into what encryption is and how to think about its importance in manufacturing. Before we take the plunge, let’s see how we got here these past few months. We started earlier this summer from the 100,000 foot level with cyber security. We dropped down to 5,000 feet with a discussion on manufacturing passwords, and then we lowered the plane to 500 feet withmanufacturing authentication and authorization. Today we are taking the topic to the 100-foot level with a discussion of encryption.
There are three questions I am going to answer directly in this article as well as providing a quick summary of the manufacturing security articles this summer. What exactly is encryption? We are told to look for this lock anytime we are dealing with important information, but what is happening under the covers? How does this apply to the shop or plant floor?
Sending information securely is an old problem. How does someone send a message over a public medium with the guarantee that only the person who should be receiving it can read it? The classic example of this is in the military, but there are many examples where this is critically important in manufacturing as well. A military leader needs to be able to send commands to troops in the field, but the generals do not want that information intercepted by the enemy. A very important reason the Nazis lost World War II was because of the incredible work by the British at Bletchley Park when they were able to intercept and decode the Germans’ messages by understanding how the Enigma machine worked. It is widely believed that this might have taken two years off the length of World War II. Sending information is even more important today and not just for the military. GM might want to send the design for a new model of the Corvette Stingray to a supplier over the Internet, and GM certainly does not want that information shared with competitors or the press.
I mentioned previously in this series, but it is worth repeating. The way to think about security is first from the absolute highest level and then work your way down from there. The highest levels of security have to do with the nature of information in general such as data at rest and data in flight. Data at rest is information that is sitting on disk drives and should be encrypted. Data in flight refers to information that is being moved from one location to another and should also be encrypted. What exactly is encryption? It’s taking information and scrambling it with a key in such a way that only the intended recipient can read it with a key. The important and significant challenge is the complexity of these keys and the handling of these keys. This is really no different than locks on your house. Encryption means that the information is “scrambled” and is not readable, decrypted, without the appropriate key. The size of these keys and the encryption algorithm are just a couple of the decisions that must be made. Individuals earn Ph.Ds researching these topics alone.
Before we get a little more technical on manufacturing encryption, let’s take a quick look back on how we got here. In June, we started talking about cyber security. I mentioned that as manufacturing continues to embrace complete supply chain integration, cradle to grave digital thread tracking of parts, open and royalty-free standards such as MTConnect, as well as networking across the board, the importance of cyber security in manufacturing will continue to grow.
In July, we started talking about the fact that as manufacturing becomes more and more interconnected with the outside world, the need for security will increase exponentially. Security can be thought of as an onion with different layers that are needed for protection. A strong password for a user would be something along the lines of a!&tR)^-n8@#&y\B. That password is 16 characters in length and has a variety of characters to it. The obvious challenge with that type of password is that it is hard for us humans to remember. The trick is having a password that a human can remember and makes it difficult for computers to guess by having that mix of characters and a long password.
In August we discussed “Manufacturing Authentication and Authorization”. AIn that article, I used Peter Steiner’s classic New Yorker cartoon with the caption “on the Internet, nobody knows you're a dog.” This cartoon has one dog sitting on a chair and typing on a computer while speaking to a second dog sitting on the floor. It perfectly summarizes the problem with computer security. Specifically, how do you know the person is really who they say they are, and what exactly is that person allowed to do? In the world of security, this is called authentication and authorization, which are two of the key pillars upon which applications and data depend for safe operations.
Most people have a rough idea how encryption works, but let’s take a little bit more detailed look. Let’s say you are an MTInsight subscriber. For those who are not familiar with MTInsight, it’s a business intelligence (BI) tool based on three key elements: BI software, AMT's experience and analysis, and our unique data warehouse — all of the information AMT tracks on your markets, benchmarking surveys, industry forecasts, your competitors, customers and supply chain.
If you type MTInsight.org into your browser and you see the following:
There are a few things worth pointing out.
- A lock on the far left of the toolbar.
- You will notice that the when you typed in MTInsight.org that the text changed from black togreen and the complete name for AMT appeared. The purpose of the certificate is to insure that AMT is the owner of the site. This type of certificate is known as an EV or Extended Validation Certificate. EV Certificates require much greater business verification and validation on exactly which organization is the legal entity that owns this site than a standard certificate requires. When you see an EV Certificate it is a sign that the company takes security very seriously.
When you go to a website that has a lock, you can learn the specifics of the certificate clicking on the site’s name next to the lock. For example, this is what you would see for MTInsight.org:
We are told to look for this lock anytime we are dealing with important information, but what is happening below the covers? There are a number of steps, but we are going to keep this at a high level. MTInsight.org has two keys: A public key that anyone can see and private key that only MTInsight.org knows. A key is a very long number. What makes this public key and private key work is something called one-way function. A one-way function is a mathematical algorithm that can use a public key to encrypt data and the only way to decrypt it is with the private key. Even the entity that encrypts the data cannot decrypt it without the private key.
When MTInsight.org is entered into the browser toolbar, the first thing that happens is your browser verifies with the EV Certificate that MTInsight.org is the real MTInsight.org and not an imposter site. After that happens, your browser and MTInsight.org need to speak in a secure fashion. In order to do that, both sides must agree on a secret key. The question now becomes, how do they share a secret key?
- You type https://MTInsight.org into your toolbar.
- MTInsight.org sends its EV Certificate and its public key to your browser.
- Your browser verifies this is MTInsight.org is valid, then your browser uses MTConnect.org’s public key to send the secret shared key that both systems will use to securely communicate.
- MTConnect.org uses its private key to decrypt the message from your browser and then starts using the shared secret key for communication.
How does this apply to the shop or plant floor? Remember that both data at rest and data in flight should be encrypted. We covered lots of security information this summer. If I could leave you with just one message it would be Andy Grove of Intel’s timeless advice, “only the paranoid survive.” When it comes to manufacturing security, be very, very paranoid. It will serve you and your company well in the long run.
No comments:
Post a Comment