Digital Product Passports Help Manufacturers Tackle Cybersecurity | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #ransomware


Additive manufacturing, artificial intelligence and other new technology make it easier than ever for unscrupulous parties to flood the supply chain with counterfeit parts and out-of-spec components. However, engineers at Georgia Tech University believe the answer to this challenge isn’t just better parts; it’s better proof.Digital passports can help manufacturers secure their products and protect their factories. The technology is being used on everything from high-tech weapons to high-end toilets.

A digital product passport (DPP) is a comprehensive record that provides detailed information about an item throughout its life cycle, from production to disposal. It tracks components, materials and production processes through a scannable data carrier like a QR code or RFID tag. DPPs enable manufacturers and their suppliers to address auditing, traceability and transparency demands.

According to a recent report by Grand View Research, the global DPP market is projected to grow 36 percent annually between now and 2033. That’s due to increasing cybersecurity threats and widespread use of digital twins, edge computing, data interoperability and other technology.

“Today, manufacturers are adopting digital passport to document a part’s full production history,” says Tom Kurfess, Ph.D., a mechanical engineering professor who serves as executive director of the Georgia Tech Manufacturing Institute (GTMI). “It can be scanned at any point in the supply chain.”

Kurfess and his GTMI colleagues have been studying how counterfeit parts and out-of-spec components are entering U.S. defense supply chains through thousands of small- and mid-sized suppliers that make up the lower tiers of the industrial base. They believe DPPs can secure against tampering.

The U.S. defense supply chain is vulnerable to counterfeit parts and out-of-spec components. Photo courtesy Northrop Grumman Corp.

“The Pentagon has estimated that up to 15 percent of the spare and replacement electronic parts it buys are counterfeit,” warns Kurfess. “Without verification built into the supply chain, a single bad part, or a single exposed manufacturing controller, can compromise a weapons system or halt a production line.”




Looking for quick answers on assembly and manufacturing topics?


Try Ask ASM, our new smart AI search tool.













Ask ASM →

Kurfess claims that a DPP infrastructure can help manufacturers ensure that parts prove what they claim to be. “I am not a counterfeit part; I was made according to specifications, and you can insert me into an F-35 jet engine with high confidence that I’m going to perform as specified,” says Kurfess.

In addition to aerospace and defense manufacturers, GTMI works with a variety of other companies, such as automakers and auto suppliers.

While a fighter jet represents the apex of tracking stakes, Kurfess notes that the underlying infrastructure has already proven effective on much more ordinary assembly lines. He points to a plumbing fixture plant in Morrow, GA, where every component carries a QR code that pulls up the humidity conditions during manufacturing, the processing steps and who worked on the part.

The Toto USA factory is a showcase for next-generation manufacturing technology designed to advance quality, precision and operational efficiency. The 363,393-square-foot facility can build up to 300,000 toilets annually. It also mass-produces bathtubs, bidets, faucets, sinks and other types of high-end bathroom products.

Because its products undergo high-heat firing in kilns, Toto uses heat-resistant QR codes. This allows automated systems to track the individual history and structural data, while also performing quality checks of each unit in real time.

Heat-resistant QR codes are used to track part history, check structural data and perform quality checks in real time. Photo courtesy Toto USA

Much of GTMI’s work involves small- and mid-sized manufacturers that supply nuts, bolts and castings to prime contractors such as General Motors and Lockheed Martin. Smaller companies typically lack the in-house IT resources and OT expertise of a major OEM.

The Georgia Tech engineers configure cloud tools that automate measurement tracking to meet U.S. Department of Defense documentation and cybersecurity requirements, working directly with smaller suppliers to build that capability instead of leaving them to develop it alone.

GTMI engineers have also been collaborating with their colleagues at Georgia Tech’s Supply Chain and Logistics Institute, in addition to the School of Cybersecurity and Privacy.

Research conducted by those organizations has discovered that adversaries can easily insert “logic bombs” into design files: code that leaves a manufactured part looking normal until it fails on command, whether that part is a drone propeller or a power grid transformer. Another potential risk involves imported machine tools or robots that arrive with vulnerable or deliberately compromised software already installed.

Without verification built into supply chains, a single bad part can compromise a weapons system or halt a production line. Photo courtesy Lockheed Martin Corp.

In fact, many machine controllers are vulnerable to “outside actors,” says Kurfess. That’s because many manufacturers haven’t developed cybersecurity measures at the pace of sectors such as finance or energy, in part because engineers built legacy equipment for reliability, not to resist a deliberate attack.

Kurfess believes that operational data is “the most valuable asset” that a supply chain organization owns. “There are a lot of nefarious actors out there who just want to steal information,” he points out. “If someone stole files, they could potentially make counterfeit products using your proprietary data.

“Or, they could slightly alter the dimensions on critical components such as automotive brake calipers or jet engine turbine blades,” explains Kurfess. “Even a slight variation on those types of products could have catastrophic consequences.”

GTMI is applying artificial intelligence technology directly to quality verification at its Advanced Manufacturing Pilot Facility (AMPF), where manufacturers can build and verify a part under one roof instead of shipping it elsewhere for testing.

AMPF’s connected machines talk to each other using AI and a knowledge management system, verifying a part’s material composition and durability as it’s made rather than after the fact. That enables manufacturers to confirm they’re building what they intend to build without shipping delays.

Kurfess says the next test is scale: whether digital product passports, secure cloud tracking and AI-verified quality checks can move from a handful of pilot programs and flagship facilities to the thousands of small shops around the United States that make up the defense industrial base.

“The technology, from Bluetooth calipers to readily available and cost-effective cloud accounts, is already cheap enough that cost isn’t the barrier,” notes Kurfess. “What remains is installing, securing and standardizing those tools across a supply chain that still runs largely on paper.”

For more information on research at Georgia Tech, read these articles:

Kia Uses Virtual Reality to Train Assemblers

ASSEMBLY Audible: Inside the Self-Driving Factory Lab

Georgia Tech Develops Safer, Cheaper, More Powerful Batteries

——————————————————-
Click Here For The Original Source.