FIELD / OT
Onboard, Trackside & Field Networks
- Identify Target Devices & Connection Segments
- Separate Network Segments & Define Permitted Communications
- Device Authentication & Secure Key Delivery
Field Connection Boundary
HOME / CYBERSECURITYProtecting communications,
CYBERSECURITY · MOBILITY TRUST
Protecting communications,
preserving trust in operations.
Security engineering for railway control communications and road and AI operational infrastructure.
We design cryptographic keys, networks, operating permissions and verification evidence as one system.
KMC · KEY MANAGEMENT CENTER
The cryptographic key lifecycle,
managed consistently at the center.
CREWAVE designs and develops KMC systems integrating key management applications, HSMs, operations and audit functions. We incorporate key distribution methods for the target control communications and field operating procedures.
- Key Management Application
- KMC Core · Key Policy & Lifecycle · Device Registration · Distribution & Renewal Tasks
- Device Interfaces
- Online & Offline Key Delivery · Key Application Results · Failure & Reconnection Conditions
- HSM & Protected Channels
- A700·PKCS#11 Integration · PKI·TLS Connection Protection · Certificates & Trust Configuration
- Operations & Audit
- Web UI·CLI · Role-Based Permissions · Approval of Critical Tasks · Task & Status History
- Testing & Operational Handover
- Requirements-to-Test Traceability · Integration & Exception Testing · Backup, Recovery & Change Management Procedures
KMC / KEY MANAGEMENT CENTER
Operations & Management ConsoleWeb UI · CLI · Role-Based Access · Task History
Policy Configuration · Task Requests · Processing Results
CREWAVE SOFTWAREKey Management Core
Key LifecycleDistribution & Renewal PoliciesDevice & User ManagementLogs & Audit
PKCS#11 Integration
HSMProtected Key Storage · Cryptographic OperationsThales Luna Network A700
Online & Offline Key Delivery
Target DevicesKey Application · Renewal · Status IntegrationTrackside RBC · Onboard STU
The key management application manages operating policies and delivery procedures and integrates the HSM’s key protection and cryptographic functions.
CREWAVE ENGINEERING
Key Management Software & System Integration
We design device registration, key distribution and renewal policies, management consoles, and audit and recovery procedures for each target system.
HSM INTEGRATION
Thales Luna Network HSM A700
We integrate the key protection and cryptographic operations provided by Thales HSMs with CREWAVE’s key management application through the PKCS#11 interface.
SECURITY ARCHITECTURE
Clear boundaries between devices, centers and operators.
A security architecture designed and integrated to project requirements.
CREWAVE / KMC
Central Key Management
Key Policy & LifecycleDistribution & Renewal ManagementHSM Secure Storage & OperationsAudit & Recovery Management
Key Management Application + HSM
OPERATIONS / GOVERNANCE
Operations & Security Management
- Operator Authentication & Role-Based Permissions
- Critical Task Approval & Audit Records
- Export, Retention, Backup & Recovery Policies
Management Access Boundary
Field ↔ KMC: Key Delivery & Renewal for Target DevicesOperator ↔ KMC: Authentication, Permissions, Approval & Audit
CYBERSECURITY SCOPE
Security integration grounded in what needs protection.
01 / SECURE COMMUNICATION
Field Communications & Remote Access
We distinguish communication paths from operational access across onboard, trackside and control center systems. We design authentication, encryption and access policies with existing equipment and availability requirements in mind.
Design & Review ItemsAsset & Communication Inventories · Network Boundaries · Access Policies · Interfaces
02 / IDENTITY & KEY
Device Identity & Cryptographic Keys
We connect device registration and key distribution with replacement, renewal and destruction procedures. We review online and offline operating conditions and HSM integration methods.
Design & Review ItemsKey Policies · Distribution Procedures · HSM Integration · Operating Permissions
03 / DATA GOVERNANCE
AI & Control Data Protection
We define the purposes and authorized users for collecting video, events and operational history. We establish data retention, export and deletion policies and an audit framework.
Design & Review ItemsData Classification · Role-Based Permissions · Retention Policies · Audit Records
04 / RESILIENCE
Trust That Persists Through Change
We connect security requirements with design and testing, enabling vulnerability remediation, configuration changes, backup and recovery to be reviewed during operations.
Design & Review ItemsRequirements Traceability · Test Results · Change History · Recovery Procedures
PROJECT INTEGRATION
From Protection Scope to Operational Handover.
- 01
Define the Protection Scope
Distinguish devices, data, communication paths and operational access.
- 02
Design Policies & Interfaces
Define authentication, key delivery, permissions, audit and system integration requirements.
- 03
Test Functions & Exceptions
Verify normal operation, access denial, communication failure and recovery conditions.
- 04
Operational Handover
Document configuration information, change history, and backup and recovery procedures for operations.
ENGINEERING EVIDENCE
Connecting security needs with design
and verification criteria.
| Stage | Review Scope | Example Deliverables |
|---|---|---|
| Requirements Definition | Define protection scope, operational boundaries and device requirements | Requirements Specification · Risk Review |
| Design & Integration | Design key delivery paths, operating permissions and approval procedures | SRS / SDD / ICD |
| Testing & Verification | Functional, integration, exception and security testing and assessment | STP / STR · Test Evidence |
| Traceability & Handover | Assess requirement changes and update design and verification items | RTM · Operations & Maintenance Documents |
IEC 62443 Applicability Review
We analyze requirements for products, systems and development processes with the industrial control system security lifecycle in mind. We define applicability and test criteria based on the target system’s assets and operating environment, and connect them with design and verification.
DEFINE YOUR SECURITY SCOPE
Let’s define the security scope you need.
Open the Security Requirements & Deliverables ChecklistLET’S MOVE FORWARD
The next chapter of mobility,
made real together.
From site conditions and product needs to implementation, operations and technical collaboration.