Online access and functionrestrictionThe S7 CPU has four access levels, in order to limitaccess to specific functions. Setting up theaccess level andpassword will limit the functions and memory ranges that areaccessiblewithout a password. The individual access levels and theassociated passwords are defined inthe object properties of theCPU. Legitimating oneself with a configured password grantsaccessaccording to the associated protection level.Table 2-1Accesslevels Restriction of accessFull access (no protection) Hardwareconfiguration and blocks can be read andchanged by anyone.Readaccess for F blocks (only with F-CPUs) F blocks in the safetyprogram cannot be modifiedwithout legitimation with the passwordassociated withthis access level or a higher access level.Readaccess This access level grants only write-protected access tothehardware configuration and the blocks unless thepassword isentered. Without the password, thefollowing functions can beutilized:• Read the hardware configuration and blocks• Download thehardware configuration and blocksto the programming device• Readdiagnostic data• Display online/offline comparison results• Set thetime• Change operating mode (RUN/STOP)The following functionscannot be run without enteringthe password:• Download the blocksand hardware configurationto the CPU• Write-based test functions•Firmware update (online)HMI access This access level only allowsthe following when thepassword has not been entered:• HMI access•Read diagnostic dataExample: With the "HMI access" access level,you cango online and display diagnostic icons for the statesofobjects.Tags can be read and written via an HMI device.Thefollowing functions cannot be run without enteringthe password:•Download the blocks and hardware configurationto/from the CPU•Display online/offline comparison results• Change operating mode(RUN/STOP)• Write-based test functions• Firmware update (online)2Security mechanisms on the S7 CPUSecurityArticle ID: 90885010,V3.0, 11/2022 19© Siemens AG 2022 All rights reservedAccess levelsRestriction of accessNo access (complete protection) Onlyidentification data can be read, e.g. via"Accessiblesubscribers".With complete protection, the CPU forbids:• Read andwrite access to the hardwareconfiguration and blocks• HMI access•Modification in the server function forPUT/GETcommunicationOperational performance with protection levelactivatedA password-protected CPU behaves as follows when inoperation:• The CPU protection takes effect once the settings aredownloaded to the CPU and a newconnection has been established.•Before an online function is executed, the necessary permission ischecked and, ifpassword-protected, the user is prompted to enter apassword.• The password-protected functions can only be executedfrom a programming device or PCat any given time. Anotherprogramming device or PC cannot sign in with a password.• Accesspermissions to the protected data apply while the online connectionis active, or untilthe access protection is removed manually via"Online > Delete access permissions".Going online with apassword-protected CPUGoing online with a password-protected CPUrequires read access as of STEP 7 V14.Therefore, you must enter thepassword for read access when you go online or, if no passwordwasconfigured for this, you must enter the password for full access.Ifyou have a fully protected CPU and you only have a password for HMIaccess on hand,cancel the password prompt after the read accesspassword prompt. You will then be promptedto enter the password forHMI access. The permission for HMI access is not sufficient fortheonline/offline comparison, however. For this you will need readaccess permissions.NoteConfiguring an access level is not areplacement for know-how protection.It prevents impropermodifications to the CPU by restricting download permissions.However,the blocks on the SIMATIC Memory Card are neitherwrite-protected nor read-protected.Know-how protection should beused to safeguard the program code.2 Security mechanisms on the S7CPUSecurityArticle ID: 90885010, V3.0, 11/2022 20© Siemens AG 2022All rights reserved2.3 Block protectionVarious block protectionmechanisms are available in STEP 7 (TIA Portal) to protect theknowhow in the blocks' programs from unauthorized persons.2.3.1Know-how protectionKnow-how protection lets you guard blocks oftype OB, FB, FC and global data blocks againstunauthorized accessby using a password.Take the following features into account withknow-how protection:• You cannot manually protect instance datablocks; they are dependent on the know-howprotection of theassociated FB. This means that when you generate an instance datablockfor a know-how-protected FB, the instance data block likewisereceives know-howprotection. This happens regardless of whether youexplicitly create the instance data blockor whether it wasgenerated by a block call.• With global data blocks, you cannotedit the start values and comments, but this is possiblewithinstance data blocks.• ARRAY data blocks cannot be provided withknow-how protection.• Storage space re may be higher withknow-how-protected blocks.• During a comparison between the offlineand online version of know-how-protected blocks,only thenon-protected data are compared.• Further access to the block isnot possible without a password.• When you add a know-how-protectedblock to a library, the resulting master copy alsoreceived know-howprotection.RestrictionsWith a know-how-protected block, only thefollowing data are readable without a password:• Call parameters:Input, Output, InOut, Return, Static• Block title• Block comment•Block properties• Tags of global data blocks, minus informationabout the location of useThe following actions can be carried outwith a know-how-protected block:• Copying and deleting• Calling ina program• Offline/online comparison•DownloadingReadmeReferencesYou can find more information at thefollowing link: \7\ in chapter 4.3, specifically regarding:•Setting up know-how protection for blocks• Opening blocks protectedby know-how protection• Removing know-how protection from blocks2Security mechanisms on the S7 CPUSecurityArticle ID: 90885010,V3.0, 11/2022 21© Siemens AG 2022 All rights reserved2.3.2 CopyprotectionCopy protection links a program or blocks with a specificSIMATIC Memory Card or CPU. Bylinking the serial number of aSIMATIC Memory Card or CPU, use of the program or block in only possible in connection with this specific SIMATIC MemoryCard or CPU.If a block with copy protection is downloaded to adevice whose serial number does not matchthe defined serial number,the download process will be rejected. However, this does notmeanthat blocks without copy protection cannot be downloaded.Copyprotection is set up and the associated serial number is enteredvia the block properties.Applications• If the program is bound tothe serial number of the CPU, use of TIA Portal to adjust theserialnumber is mandatory upon hardware replacement in the event of afault.• If the serial number is linked to the memory card, thehardware can be replaced and thememory card taken from the old CPU.Due to the fact that the program is stored on thememory card, it isstill possible to ensure that the program only runs on oneCPU.NoteWhen setting up copy protection for a block, it isimportant that this block also receive blockprotection. Withoutknow-how protection, anyone could reset the copy protection.Copyprotection must be set up prior to block protection. The copyprotection settings arewrite-protected when the block has know-howprotection.There are two options for adding the serial number:•Manual entry of serial number:The serial number must be knownduring the engineering phase.• Automatic assignment duringdownload:The serial number does not need to be known forengineering.During download to a new CPU, the password defined forcopy protection is re Security mechanisms on the S7CPUSecurityArticle ID: 90885010, V3.0, 11/2022 22© Siemens AG 2022All rights reserved2.3.3 Write protectionSet up write protectionfor blocks of type OB, FB or FC to prevent inadvertentmodifications.Blocks with write protection can only be opened inread-only mode. However, you can still editthe block properties.There are no restrictions on diagnostics.NoteNote that writeprotection is not the same as know-how protection. When a block iswriteprotected, you cannot set up know-how protection on top ofthis. Remove the block's writeprotection if you want to give itknow-how protection.2 Security mechanisms on the S7CPUSecurityArticle ID: 90885010, V3.0, 11/2022 23© Siemens AG 2022All rights reserved2.4 CPU integrity protectionIntegrity refers tothe protection of data against unauthorized modification ordeletion.In the context of CPU security, this entails thefollowing:• Protection of confidential CPU configuration data•Protection of the CPU firmware signature2.4.1 Protection ofconfidential PLC configuration dataTrouble-free functioning ofcertificate-based communication mechanisms for securecommunication(see chapter 2.1) requires that the private keys employed by thesecertificatesare protected as much as possible.As of TIA Portal V17,you can set up a user defined password to protect these keys andothersensitive data.Password for protecting confidential CPUconfiguration dataTo protect the confidential configuration data ofthe CPU, for example certificates and privatekeys, enter thepassword in TIA Portal.The following Figure is a simplifiedrepresentation of how confidential CPU configuration data(forexample a standard S7-1500 CPU) can be protected.Figure 2-5 Securememory concept12The project and key information is stored indifferent memory ranges during the initial download:1. The projectis stored in the load memory (SIMATIC Memory Card).2. The keyinformation is stored in a memory range in the CPU. This key isused to read theconfidential configuration data on the SIMATICMemory Card.For target systems such as S7-1200 CPUs and softwarecontrollers with other storageconcepts, the implementation isadapted to fit the relevant storage concept. The principleremainsthe same, however.2 Security mechanisms on the S7CPUSecurityArticle ID: 90885010, V3.0, 11/2022 24© Siemens AG 2022All rights reservedTwo memory ranges for additional securityTheproject and the keys belong together like two interlocking puzzlepieces. The project islinked with the downloaded key information;the downloaded key information is in turn linkedwith the passwordthat was assigned during configuration. The project and keyinformation mustmatch, otherwise the CPU will not start.Theprinciple of two separate memory ranges also applies for S7-1200CPUs and S7-1500 CPUversions without a SIMATIC Memory Card, forexample software controllers, PLCSIM orPLCSIM Advanced. In theversions without a SIMATIC Memory Card, two separate partitionsareused so that the two information elements can be managedindependently of one another.Figure 2-6 Secure memoryrangesReadmeReferencesFurther information on setting up protectionof confidential PLC configuration data, as well asthings to notewhen replacing the CPU, can be found at the following applicationexample link: