hazelnut

The digitization and networking of railway control and signaling technology (LST) make it possible to improve operational processes and transport performance in rail transport. However, networked IT-based infrastructures are also vulnerable to hacker attacks. To address this, a research consortium led by Fraunhofer SIT is developing a hardware-based IT security platform tailored to the specific requirements of rail transport, such as the long service life of infrastructure components. The solutions developed in the project “Hardware-Based Security Platform for Railway Control and Safety Technology”—HASELNUSS for short—are being tested, analyzed, and further developed at the DB Netz AG test center and the Darmstadt railway operations site.

The security architecture is based on a "Trusted Platform Module (TPM) 2.0," which acts as a hardware root of trust, and the PikeOS microkernel operating system. This serves as the foundation for innovative services for secure identity management, software integrity monitoring, secure system updates, and attack detection. The TPM Software Stack (TSS) 2.0, developed by SIT researchers, will be used to access and utilize the TPM’s security services.

Fraunhofer SIT has extensive experience in the field of hardware-based IT security and trusted computing and is developing the following within the project:

• Profiles for TPM and TSS 2.0 that meet the requirements for railway deployment regarding resource constraints, security levels, etc.
• Methods for verifying and ensuring the trustworthiness of LST components
• Methods for integrity monitoring and for detecting tampering at runtime

With the help of TPM 2.0, advanced security solutions can be developed to secure communication within the control and safety technology network and the LST components themselves. For example, the current system state can be continuously monitored by combining TPM-based protocols with a health monitor to detect tampering. This enables infrastructure operators to quickly identify problems and attacks, partially prevent them, and respond appropriately as needed.

Secure operation with reduced costs

The solutions developed and piloted in the project enable secure rail operations with increased efficiency and lower operating costs. Since the HASELNUSS security architecture enables the secure use of standard technologies, new business models continue to emerge for new market participants.