Policy-based security for distributed manufacturing execution systems

ABSTRACT This paper discusses the main security-related challenges raised in distributed Manufacturing Execution System (MES) architectures. In contrast to monolithic control architectures, where security is centralised, the distributed control architectures encourage the migration of the information processing to the shop floor, using intelligent devices, thus enabling local decision-making. While the benefits of this distributed architecture are obvious, the security aspects, specifically pertaining to unauthorised access to information, theft of proprietary information and impersonation still require some formalisation. This paper proposes a policy-based mechanism to handle transport security by introducing a real-time Public Key Architecture platform using certification authorities to generate certificates on the fly and secure socket communication. Additionally, this paper introduces a document-level encryption and signing mechanism for all MES messages exchanged between intelligent products, sensors, shop floor resources and different MES components. This is especially useful for securing parts of the architecture that cannot rely on transport layer security due to functional requirements, i.e. content-based message routing at manufacturing service bus layer.