Industrial Control Systems (ICSs) play a critical role in various industries, automating processes and efficiency optimization. However, these systems have security vulnerabilities that make them prone to cyber attacks, so it is crucial to have strong access control mechanisms in place. This master thesis focuses on the investigation, development, and evaluation of workflow-driven dynamic authorization for modular automation systems. The authorization enables specifying of policies that can adapt in real-time to the dynamic security environment of ICSs. Furthermore, the thesisexplores the efficiency of authorization in terms of execution time, memory consumption, andtoken size through experimental evaluation. The experimental evaluation compares three variationsof token population: a baseline approach that directly encodes accesscontrol list permissions into the token, and two token population algorithms that aim to reduce thetoken size by replacing permissions with overlapping roles. The results show that the baseline approach achieves the shortest execution time and lowest memory consumption, but leads to increased token sizes. On the other hand, the token population algorithms reduce the token size at the costof increased execution time and memory consumption. The choice between these approaches wouldinvolve trade-offs and would depend on the specific requirements of the ICSs environment. / InSecTT

Modulare Prozessanlagen bestehen aus einfach austauschbaren Prozess- und Funktionseinheiten, deren Konfiguration (Aufbau) und Rekonfiguration (Umbau) neue Möglichkeiten der flexiblen Prozessrealisierung eröffnen. Die Wandelbarkeit der Anlagen stellt aus Perspektive der funktionalen Sicherheit eine Herausforderung dar, da bestehende Methoden und Vorgehensweisen auf den verhältnismäßig statischen Betrieb von konventionellen Anlagen optimiert sind. Um den Zielkonflikt zwischen Flexibilität und Sicherheit abzumildern wurde ein Konzept zur Orchestrierung von verteilten Sicherheitssystemen entwickelt und in einer Demonstrationsanlage erfolgreich erprobt. Der Konzeptentwurf integriert sowohl technische als auch menschliche Anforderungen, mit dem Ziel, Operateure durch eine geschickte Systemgestaltung zur Beherrschung der Re-Konfiguration zu befähigen. / Modular process plants consist of easily exchangeable process and functional units whose configuration (assembly) and reconfiguration (modification) open up new possibilities for flexible process implementation. The changeability of the plants poses a challenge from the perspective of functional safety, since existing methods and procedures are optimized for the relatively static operation of conventional plants. To mitigate the trade-off between flexibility and safety, a concept for orchestrating distributed safety systems was developed and successfully tested in a demonstration plant. The concept design integrates both technical and human requirements, with the goal of enabling operators to master reconfiguration through smart system design.