Manufacturing

This research is being led by Dr. Elliott and Shimon Modi

Documents such as the ISA-TR99.00.01-2004 Security Technologies for Manufacturing and Control Systems categorizes security issues related to hardware and software systems including “Distributed Control Systems, Programmable Logic Controllers, Supervisory Control and Data Acquisition Systems, Networked Electronic Sensing Systems and monitoring, diagnostic, and assessment systems” (ISA, 2004, pg 2). Furthermore, the technologies associated with the protection of these systems includes: “authentication and authorization; filtering/blocking/access control; encryption; data validation; audit; measurement; monitoring and detection tools, and operating systems” (ISA, 2004, pg.2). And whereas this report only looks at physical and logical security, there are also additional benefits in providing these technologies to comply with governmental regulation (such as FDA 21 CFR 11 as required in the health and pharmaceutical industry) as well as safety requirements. According to Reiley (2003), and the ISA-SP99 committee report, “computer systems in the manufacturing environment typically rely on traditional passwords for authentication” (pg. 3) providing risks with their security.

 

The American Society for Industrial Security and Price Waterhouse (ASIS/PWC) study determined that the greatest losses occur in information related to Research and Development (R&D) and Manufacturing Processes. This is particularly relevant in the pharmaceutical industry. The Pharmaceutical Industry Profile for 2002 pointed out that the pharmaceutical industry budget for R&D has grown from $1.3B in 1977 to and estimated $32B in 2002.  The use of biometric technology for access, authentication, electronic signatures, and action traceability will grow rapidly in the pharmaceutical industries due to both new and evolving electronic records regulation and need to protect intellectual property. New regulations in both the United States and European Union require industry to ensure the integrity, authenticity and confidentiality of regulated electronic records.

 

There is also increased need to protect intellectual property because, unlike many industries, patented and non-patented intellectual property is the primary source from which pharmaceutical company revenues are derived. The initial targeted user community within these pharmaceutical organizations will be the operators of the distributed control systems where the FDA has expressed concern regarding the ability to authenticate an individual who performs any type of transaction, in the manufacturing process, that would be governed by the regulations associated with electronic signatures and the guidance of 21 CFR Part 11.

 

As manufacturers move towards a more connected collaborative environment in order to compete in global businesses and geographically disparate facilities, concerns that their proprietary manufacturing processes and intellectual property could be exposed to damaging compromise on a worldwide scale are increasing. Industrial automation suppliers (i.e. Emerson & Rockwell Automation) will need to regard the security of plant systems with the same sense of urgency that the IT community now uses with regard to the security of computing, both behind and in front of their firewalls, and internet technology.

It is also important to understand the potential impact of Sarbanes-Oxley and HIPAA to this manufacturing environment. The word potential is used because much of the perceived impact is based on speculation due to a less than complete understanding of the both of these regulations.

 

Adminstration Area - this area is used to enrol users into the system, and includes Hand Geometry, Fingerprint, and Iris Recognition. This is used to demonstrate access control and single sign on.
Another view of the Adminstration Area - this area is used to enrol users into the system, and includes Hand Geometry, Fingerprint, and Iris Recognition. This is used to demonstrate access control and single sign on.
Mock up of an exterior hand geometry machine connected to the network, as well as a Rockwell PC control, using Iris Recognition as a single sign on.
Rockwell HMI integrated with biometrics - both Iris Recognition and Fingerprint Recognition
Outside in the dock area - a hand geometry machine mock up
Automated Manufacturing System - it is envisaged that biometric technologies will secure these machines
Offline Rockwell Controls Wall - here single sign on through biometrics will be deployed.

Previous Work

  Modi, S. K., & Elliott, S. J., (2005). Securing the manufacturing environment using biometrics, Proceedings of the 39th Annual International Carnahan Conference on Security Technology (ICCST) (pp. 275-278). Las Palmas de G. C., Spain.
  Wu*, G., Latif, N. & Elliott, S. J. (2005). Security solutions for CNC machine operations based on biometric security.Selected Papers of the National Association of Industrial Technology Annual Conference. St. Louis, MO.
Modi, S. K., Harriger, B. C., Elliott, S. J., Young, M. R., (2005). Securing the Manufacturing Environment using Biometrics , Center for Education and Research in Information Assurance and Security "Security in Motion" conference, West Lafayette, IN.
2005 - Open Control Raises the Bar for Access Control (PharmaManufacturing.com)