IED-OS is deployed in SIMATIC IPC Industrial Edge Devices during production. Operating system updates are highly recommended and can be performed via Industrial Edge Management (IEM).
| Component | Purpose | Description |
|---|---|---|
| Trusted deployment | Trusted environment for first installation | The Edge Device is shipped with a fully installed Industrial Edge Device OS (IED‑OS), secured from the manufacturer's site by default. |
| Secure Boot | Verified boot artifacts | To align with UEFI BIOS, boot artifacts in the OS are digitally signed by Siemens. |
| IMA | Linux Integrity Measurement Architecture | OS artifacts include the Linux Integrity Measurement Architecture to ensure the integrity of the loaded modules. |
| Measured Boot | Measure trusted boot and update channels | The measured boot checks the integrity of the entire boot chain and compares it to the trusted initial deployment. Fingerprints are stored in crypto hardware. |
| Encrypted Artifacts | Encrypt delivered software artifacts (IED-OS software) that are used with Service Stick for maintenance | Delivered software update artifacts are encrypted prior to release. These encrypted artifacts can only be used through the Service Stick |
| Digitally signed software artifacts | Integrity and authenticity of the software artifacts | CMS (Cryptographic Message Syntax) signatures and dedicated Industrial Edge code signing certificates ensure that the code and the origin of the software has not been tampered with. |
| Vulnerability Monitor | Follow up vulnerabilities for 3rd party software components | All third-party software components in use are automatically monitored and scheduled for updates to new versions. |
| System Update | Keep the system updated and secure | Edge users always notified to schedule and update system via IEM. |
| Virus Check | Check system is safe before release | All artifacts are put through a virus checking system before being released to the production environment. |
| Disabled Access | Deny access into system via terminal | Edge users are not allowed to access the OS via virtual terminals & consoles. Access to the system is closed during the OS build process. |
| Disabled SSH | Deny access over SSH into system | SSH access is not included in the system. |
| Restricted Access to Hardware Management via OS | Deny unauthorized access to device builder services to maintain device | Device builder services provide an interface for managing devices and collecting hardware-specific configurations. Only authorized edge services can access these services. |