Günther Fischer
WIBU-SYSTEMS AG
guenther.fischer@wibu.com
Authenticate and authorize
your IIoT devices
2022-10-20 © WIBU-SYSTEMS AG 2022 - Authenticate and authorize your IIoT device 1

The CodeMeter®
Technology
2022-10-20 © WIBU-SYSTEMS AG 2022 - Authenticate and authorize your IIoT device 2

CodeMeter Technology
© WIBU-SYSTEMS AG 2022 - Authenticate and authorize your IIoT device 3
Delivery to the user
Integration into processes
Integration into software
Software Software
CodeMeter
Protection Suite
Integrate Once Deliver Many
ERP / CRM
E-commerce
CodeMeter
License
Central
Software
License Portal
CodeMeter
License
Central
2022-10-20
®

Secure Key Store – Highest Security archived with Secure Module
2022-10-20 © WIBU-SYSTEMS AG 2022 - Authenticate and authorize your IIoT device 4
Infineon SLE/SLM 97

X.509v3 Certificate Added – CodeMeter Certificate Vault
2022-10-20 © WIBU-SYSTEMS AG 2022 - Authenticate and authorize your IIoT device 5
=

Content of an X.509v3 certificate
2022-10-20 © WIBU-SYSTEMS AG 2022 - Authenticate and authorize your IIoT device 6
A X.509v3 certificate includes:
 Version and serial number
 Name of the issuer
 Name of the subject
 Period of validity
 Information on the holder's public key
 Information on the intended use of the certificate ("extensions")
 Digital signature
 Encryption algorithms used

What does a digital Certificate contain?
2022-10-20 © WIBU-SYSTEMS AG 2022 - Authenticate and authorize your IIoT device 7
 Confirms the owner of a public key
 Identity:
 Person/Device
 Organisation
 Signed by an authority
 Can contain additional attributes
Certificate
Issued for:
Common name (CN): Günther Fischer/RFID Reader
Company (O): WIBU-SYSTEMS AG
Business unit (OU): PS
Serial number: 1be10001000220613…
Public key: 0x15, 0x3c, 0xd0, 0x26, 0xd6, 0x71,
0xfa, 0xae, 0x20, 0xa6, 0x15, 0x58,
0xea, 0x3d, 0xdd, 0x36, 0x89, …
Issued by:
Common name (CN): WIBU Root
Company (O): WIBU-SYSTEMS AG
..
Valid until: 31.12.2022

Certificate Hierarchy / Certificate Chain (Trusted Root Chain)
2022-10-20 © WIBU-SYSTEMS AG 2022 - Authenticate and authorize your IIoT device 8
Root Certificate
CN: Root
Certificate
CN: Intermed. 2
Certificate
CN: RFID D. 3
Certificate
CN: RFID D. 4
Certificate
CN: RFID D. 5
Certificate
CN: RFID D. 6
Certificate
CN: RFID D. 1
Certificate
CN: RFID D. 2
Certificate
CN: Intermed. 1
Certificate
CN: Intermed. 3

Special Role of Trusted Root Certificates
2022-10-20 © WIBU-SYSTEMS AG 2022 - Authenticate and authorize your IIoT device 9

What are Certificates?
2022-10-20 © WIBU-SYSTEMS AG 2022 - Authenticate and authorize your IIoT device 10
 Digital certificates are used to uniquely identify individuals or devices.
 The person or device has a key pair consisting of a public and a secret private key.
 An Authority (Certificate Authority or CA) confirms that the corresponding
public key is assigned to this person or device.
 This confirmation is available in the form of a certificate signed with a CA private key.
 The high security of certificates is particularly evident in comparison to passwords.
 Passwords can be given away or shared intentionally or accidentally.
 Hackers can spy on passwords through phishing attacks.

Major Disaster – Private Key Compromised
2022-10-20 © WIBU-SYSTEMS AG 2022 - Authenticate and authorize your IIoT device 11

Revocation Lists
 CRL (Certificate Revocation List)
 Includes invalid (withdrawn) certificates
 Online query possible, Online Certificate Status Protocol (OCSP)
2022-10-20 © WIBU-SYSTEMS AG 2022 - Authenticate and authorize your IIoT device 12

Usage Scenarios
2022-10-20 © WIBU-SYSTEMS AG 2022 - Authenticate and authorize your IIoT device 13

Usage Scenarios
 Server Certificates
 Client Certificates
 E-Mail Certificates / VPN Certificates
 OPC UA Device Certificates
 Code and Data Integrity of Software
 …
2022-10-20 © WIBU-SYSTEMS AG 2022 - Authenticate and authorize your IIoT device 14

Storing Certificates and
Private Keys
2022-10-20 © WIBU-SYSTEMS AG 2022 - Authenticate and authorize your IIoT device 15

Storing Certificates and private keys
 As file in the file system (PEM-File)
 In a Token/Secure Element
 Certificate Store accessible via
 OpenSSL
 PKCS#11
 Microsoft KSP API (Key Storage Provider)
2022-10-20 © WIBU-SYSTEMS AG 2022 - Authenticate and authorize your IIoT device 16

PKCS#11 / Microsoft KSP
2022-10-20 © WIBU-SYSTEMS AG 2022 - Authenticate and authorize your IIoT device 17
PKCS#11 Microsoft KSP
Token/Secure Element
Internet
Explorer
Outlook
Firefox OpenVPN
Your
Application

Deployment of Certificates
2022-10-20 © WIBU-SYSTEMS AG 2022 - Authenticate and authorize your IIoT device 18

Licensor
Licensee
Cloud
Secure key management and certificate distribution
Ticket /
Fingerprint
Container
4
Ticket:
ABCDE-FGHIJ-KLMNO-PQRST-UVWXY
3
License Update
5
Ticket
2
Item
1
19
2022-10-20 © WIBU-SYSTEMS AG 2022 - Authenticate and authorize your IIoT device

Scenarios
2022-10-20 © WIBU-SYSTEMS AG 2022 - Authenticate and authorize your IIoT device 20
Device
1
Create Key Pair CSR.PEM
CSR.PEM PRIVKEY.PEM
CA
Identity Check
Identity
Create, sign, and register Certificate
Certificate
Import Certificate
2
Create Key Pair
Create and sign Certificate
Certificate + Privkey + Password
Import Certificate + Privkey
CERT.PEM PRIVKEY.PEM
Genuine Receiver
3
Create RAC RAC Identity Check
Identity
Create RAU containing PEMs
Import RAU
Create Key Pair CERT.PEM PRIVKEY.PEM
RAU FSB

Authorized Service Technician
 Securing the diagnostic software against unauthorized use
 Authorizing advanced service functions
 Encrypting documents for manuals and service information
 Meeting PCI DSS requirements for unique identification
 Support in collecting service-relevant system data (hardware
inventory + flight records)
 Interface to the training system and automatic assignment of
access rights depending on the achieved learning success
 Securing the component test systems in production
Diebold Nixdorf CrypTA (Cryptographic Technician Authentification)
© WIBU-SYSTEMS AG 2022 - Authenticate and authorize your IIoT device 21
2022-10-20

Balluff IUNO
2022-10-20 © WIBU-SYSTEMS AG 2022 - Authenticate and authorize your IIoT device 22
 OPC UAAscolab/Unified Communication
 RFID Tags
RFID D. 1
RFID D. 1

Token/Secure Element Sample: CodeMeter Cerificate Vault
2022-10-20 © WIBU-SYSTEMS AG 2022 - Authenticate and authorize your IIoT device 23

https://www.wibu.com
info@wibu.com
Europe: +49-721-931720
USA: +1-425-7756900
China: +86-21-55661790
Japan: +81-3-43608205
Thank You very much!
2022-10-20 © WIBU-SYSTEMS AG 2022 - Authenticate and authorize your IIoT device 24