“Who’s who” is an important question, not just for the publishers of biographical encyclopedias. Identities and reliable ways to identify people, devices, and real or virtual objects have become more important than ever before as much of our lives, including the industrial world, has gone digital. The new opportunities coming from this also contain new challenges: From biometric passports making travel safer and more secure to eID technologies facilitating virtual transactions and digital certificates establishing themselves as the technology of choice to authenticate devices and actors in the industrial IoT, the tech world is exploring how identity can be represented both online and offline. Digital certificates are a great tool to uniquely identify people or devices with the tried-and-tested reliability and security of a pair of cryptographic keys acting as the currency of trust: One key is public and confirmed by a neutral authority, the Certificate Authority, to belong to the person, device, or digital object, and the other is private and secure. With a certificate signed with that private key and the private key stored safely away from prying eyes, there should be no way to tamper with or steal the identity it confirms. CodeMeter Certificate Vault is our answer: The keys are kept safe and the necessary cryptographic operations handled in the smart card chips embedded in our secure hardware elements, our CmDongles. But CodeMeter Certificate Vault is more than that: It acts as a PKCS#11-compliant token provider, acts as a go-between when keys need to be accessed, e.g. through the OpenSSL API, it works perfectly in the important M2M communication standard OPC UA, and it simplifies the often laborious process of distributing and managing certificates by bringing the whole comfort and great performance of CodeMeter License Central to the certificate world. Key pairs are created, bound to their intended container, and packaged in a secure file that can simply be shipped over to their destination. With CodeMeter’s award-winning encryption, the entire process is safe from theft and tampering. In his talk, Guenther Fischer will look at three use cases that show the power of CodeMeter Certificate Vault in action.

1. Günther Fischer
WIBU-SYSTEMS AG
guenther.fischer@wibu.com
Authenticate and authorize
your IIoT devices
2022-10-20 © WIBU-SYSTEMS AG 2022 - Authenticate and authorize your IIoT device 1

2. The CodeMeter®
Technology
2022-10-20 © WIBU-SYSTEMS AG 2022 - Authenticate and authorize your IIoT device 2

3. CodeMeter Technology
© WIBU-SYSTEMS AG 2022 - Authenticate and authorize your IIoT device 3
Delivery to the user
Integration into processes
Integration into software
Software Software
CodeMeter
Protection Suite
Integrate Once Deliver Many
ERP / CRM
E-commerce
CodeMeter
License
Central
Software
License Portal
CodeMeter
License
Central
2022-10-20
®

4. Secure Key Store – Highest Security archived with Secure Module
2022-10-20 © WIBU-SYSTEMS AG 2022 - Authenticate and authorize your IIoT device 4
Infineon SLE/SLM 97

5. X.509v3 Certificate Added – CodeMeter Certificate Vault
2022-10-20 © WIBU-SYSTEMS AG 2022 - Authenticate and authorize your IIoT device 5
=

6. Content of an X.509v3 certificate
2022-10-20 © WIBU-SYSTEMS AG 2022 - Authenticate and authorize your IIoT device 6
A X.509v3 certificate includes:
 Version and serial number
 Name of the issuer
 Name of the subject
 Period of validity
 Information on the holder's public key
 Information on the intended use of the certificate ("extensions")
 Digital signature
 Encryption algorithms used

7. What does a digital Certificate contain?
2022-10-20 © WIBU-SYSTEMS AG 2022 - Authenticate and authorize your IIoT device 7
 Confirms the owner of a public key
 Identity:
 Person/Device
 Organisation
 Signed by an authority
 Can contain additional attributes
Certificate
Issued for:
Common name (CN): Günther Fischer/RFID Reader
Company (O): WIBU-SYSTEMS AG
Business unit (OU): PS
Serial number: 1be10001000220613…
Public key: 0x15, 0x3c, 0xd0, 0x26, 0xd6, 0x71,
0xfa, 0xae, 0x20, 0xa6, 0x15, 0x58,
0xea, 0x3d, 0xdd, 0x36, 0x89, …
Issued by:
Common name (CN): WIBU Root
Company (O): WIBU-SYSTEMS AG
..
Valid until: 31.12.2022

8. Certificate Hierarchy / Certificate Chain (Trusted Root Chain)
2022-10-20 © WIBU-SYSTEMS AG 2022 - Authenticate and authorize your IIoT device 8
Root Certificate
CN: Root
Certificate
CN: Intermed. 2
Certificate
CN: RFID D. 3
Certificate
CN: RFID D. 4
Certificate
CN: RFID D. 5
Certificate
CN: RFID D. 6
Certificate
CN: RFID D. 1
Certificate
CN: RFID D. 2
Certificate
CN: Intermed. 1
Certificate
CN: Intermed. 3

9. Special Role of Trusted Root Certificates
2022-10-20 © WIBU-SYSTEMS AG 2022 - Authenticate and authorize your IIoT device 9

10. What are Certificates?
2022-10-20 © WIBU-SYSTEMS AG 2022 - Authenticate and authorize your IIoT device 10
 Digital certificates are used to uniquely identify individuals or devices.
 The person or device has a key pair consisting of a public and a secret private key.
 An Authority (Certificate Authority or CA) confirms that the corresponding
public key is assigned to this person or device.
 This confirmation is available in the form of a certificate signed with a CA private key.
 The high security of certificates is particularly evident in comparison to passwords.
 Passwords can be given away or shared intentionally or accidentally.
 Hackers can spy on passwords through phishing attacks.

11. Major Disaster – Private Key Compromised
2022-10-20 © WIBU-SYSTEMS AG 2022 - Authenticate and authorize your IIoT device 11

12. Revocation Lists
 CRL (Certificate Revocation List)
 Includes invalid (withdrawn) certificates
 Online query possible, Online Certificate Status Protocol (OCSP)
2022-10-20 © WIBU-SYSTEMS AG 2022 - Authenticate and authorize your IIoT device 12

13. Usage Scenarios
2022-10-20 © WIBU-SYSTEMS AG 2022 - Authenticate and authorize your IIoT device 13

14. Usage Scenarios
 Server Certificates
 Client Certificates
 E-Mail Certificates / VPN Certificates
 OPC UA Device Certificates
 Code and Data Integrity of Software
 …
2022-10-20 © WIBU-SYSTEMS AG 2022 - Authenticate and authorize your IIoT device 14

15. Storing Certificates and
Private Keys
2022-10-20 © WIBU-SYSTEMS AG 2022 - Authenticate and authorize your IIoT device 15

16. Storing Certificates and private keys
 As file in the file system (PEM-File)
 In a Token/Secure Element
 Certificate Store accessible via
 OpenSSL
 PKCS#11
 Microsoft KSP API (Key Storage Provider)
2022-10-20 © WIBU-SYSTEMS AG 2022 - Authenticate and authorize your IIoT device 16

17. PKCS#11 / Microsoft KSP
2022-10-20 © WIBU-SYSTEMS AG 2022 - Authenticate and authorize your IIoT device 17
PKCS#11 Microsoft KSP
Token/Secure Element
Internet
Explorer
Outlook
Firefox OpenVPN
Your
Application

18. Deployment of Certificates
2022-10-20 © WIBU-SYSTEMS AG 2022 - Authenticate and authorize your IIoT device 18

19. Licensor
Licensee
Cloud
Secure key management and certificate distribution
Ticket /
Fingerprint
Container
4
Ticket:
ABCDE-FGHIJ-KLMNO-PQRST-UVWXY
3
License Update
5
Ticket
2
Item
1
19
2022-10-20 © WIBU-SYSTEMS AG 2022 - Authenticate and authorize your IIoT device

20. Scenarios
2022-10-20 © WIBU-SYSTEMS AG 2022 - Authenticate and authorize your IIoT device 20
Device
1
Create Key Pair CSR.PEM
CSR.PEM PRIVKEY.PEM
CA
Identity Check
Identity
Create, sign, and register Certificate
Certificate
Import Certificate
2
Create Key Pair
Create and sign Certificate
Certificate + Privkey + Password
Import Certificate + Privkey
CERT.PEM PRIVKEY.PEM
Genuine Receiver
3
Create RAC RAC Identity Check
Identity
Create RAU containing PEMs
Import RAU
Create Key Pair CERT.PEM PRIVKEY.PEM
RAU FSB

21. Authorized Service Technician
 Securing the diagnostic software against unauthorized use
 Authorizing advanced service functions
 Encrypting documents for manuals and service information
 Meeting PCI DSS requirements for unique identification
 Support in collecting service-relevant system data (hardware
inventory + flight records)
 Interface to the training system and automatic assignment of
access rights depending on the achieved learning success
 Securing the component test systems in production
Diebold Nixdorf CrypTA (Cryptographic Technician Authentification)
© WIBU-SYSTEMS AG 2022 - Authenticate and authorize your IIoT device 21
2022-10-20

22. Balluff IUNO
2022-10-20 © WIBU-SYSTEMS AG 2022 - Authenticate and authorize your IIoT device 22
 OPC UAAscolab/Unified Communication
 RFID Tags
RFID D. 1
RFID D. 1

23. Token/Secure Element Sample: CodeMeter Cerificate Vault
2022-10-20 © WIBU-SYSTEMS AG 2022 - Authenticate and authorize your IIoT device 23

24. https://www.wibu.com
info@wibu.com
Europe: +49-721-931720
USA: +1-425-7756900
China: +86-21-55661790
Japan: +81-3-43608205
Thank You very much!
2022-10-20 © WIBU-SYSTEMS AG 2022 - Authenticate and authorize your IIoT device 24