Industry 4.0 - or an industry that can use the Industrial Internet of Things (IIoT) - requires digital sensors, actuators, machines and systems that also collect a large amount of (real-time) data from the "physical world" and transfer it to the "digital world". In order to save time, network bandwidth, storage space and therefore also costs, it is advantageous or even necessary to process this information directly on site - at the interface between information technology (IT) and operational technology (OT), i.e. the technology for operating machines and systems. In other words, data acquisition, data processing and even data storage are increasingly being shifted from central nodes (data centers) to the network periphery at the edge from the digital to the physical, the so-called "edge".

Mastering the flow of data

In view of the sometimes exponentially increasing volume, it may even become uneconomical or even impossible to process all data in a central cloud. Some Industry 4.0 applications also require high processing speeds or even real-time responses. In order to ensure that intelligent control or assistance systems for vehicles or machines react without delay, for example, latency times must be kept as low as possible. In practice, however, this does not mean either cloud or edge. Rather, these approaches must be appropriately combined or integrated with each other depending on the use case. For example, a successful edge platform must also be able to selectively exchange data with cloud infrastructures - especially when it comes to distributed applications.

A secure basis is needed

However, the success of edge platforms is not only measured by their efficiency, usability and scalability, interoperability and the ability to orchestrate data and applications appropriately. These factors fade into the background as soon as information cannot be captured, processed effectively and transmitted securely in an absolutely reliable and tamper-proof manner: Any network is only as strong as its weakest link. If criminals succeed in misusing the digital infrastructure as a gateway or manipulating data, equipment, machinery and plant manufacturers, for example, will lose turnover and profit with every hour of lost production. Even more devastating would be the sabotage of critical infrastructures (KRITIS), with the resulting impact on the common good.

The challenges of edge computing

All of these challenges are compounded by the fact that the corresponding infrastructures are rarely "green fields". Rather, digitalization usually involves "brownfields", i.e. a mix of old and new systems. Older OT systems often cannot (or can no longer) be updated with new software, for example to close security gaps or implement additional security functions. This is because they are either functionally validated and certified as a unit, including all their components, or are simply no longer technically capable of doing so. The motto is often: "Never change a running system", although the increasingly digitalized OT sector should actually also have high security requirements - especially those that already apply to networked corporate IT.

According to the latest situation report from the German Federal Office for Information Security (BSI), the threat situation continues to worsen. The authority also points out that attackers are becoming increasingly professional in their approach and are therefore able to cause ever greater damage.

Indispensable security components of a Trusted Edge platform

Trusted edge platforms must be equipped with protective functions in view of the risks involved. This includes an industry-standard firewall that masters the communication protocols used in OT. This is the only way to develop clear guard rails for network communication (allow and deny lists) that are adapted for industrial purposes. A trusted edge can also further shield OT - at least partially - from IT and its risk situation, while at the same time allowing selective communication. In order to fulfill this function, the platform itself must be protected, for example by hardening the operating system or integrated attack detection. Ideally, the platforms have integrated dedicated security technology such as a secure element (SE). This enables cryptographic keys to be stored within a tamper-proof chip. Security functions of this kind should be equally usable for both in-house and third-party applications - ideally via interfaces (APIs). This means that not only data encryption and integrity protection - of sensor data, for example - can be implemented at a high level, but also authentication functions for remote access, for example.