Data Security

Overview

The purpose of this document is to outline the security measures in place for Progressive Components customers using the ProFile System software.

The system consists of several interdependent components including on-premise hardware, the DigiCloud system, and the ProFile System software.

In this document, the term "Client" refers to the organization that has licensed the use of the ProFile system from Progressive Components. A "Plant" is a physical location from which data is collected for use in the ProFile system.

On-premise Hardware

Two generations of hardware are in active use: version 3 and version 4. A client may use both version 3 hardware and version 4 hardware in a single plant environment.

Differences between hardware versions

Hardware from different versions is incompatible. Version 3 hardware cannot operate with version 4 hardware. Both may be independently functional in a single plant.

Version 3 hardware consists of a CVe Monitor, a Press Module and a Gateway. Version 3 hardware uses Zigbee or Xbee protocols to communicate between the machine and the Gateway.

Version 4 hardware consists of a CVe Monitor, a Repeater and a Gateway. Version 4 hardware uses Bluetooth Low Energy to communicate between the tools and the Gateway.

Version 3 hardware

On-premise hardware includes a CVe Monitor, a Press Module, and a Gateway. Version 3 hardware connects to DigiCloud’s platform and depends on the ZigBee or XBee protocols to communicate wirelessly within a plant environment.

CVe Monitor

A CVe Monitor is a small piece of hardware directly attached to a mold in your plant. A Monitor aggregates cycle time, cycle count, and temperature of an attached mold. Data is stored on the monitor and is transmitted through a wired connection to a Press Module.

When a Monitor is initially tethered to the CVe Live system via a mini USB cable, the Monitor will transmit data that has been recorded during initialization with OnDemand software. If the Monitor has not been initialized, no information is transmitted. Once a tool is cycling, the Press Module transmits the CVe Monitor serial number, cycle counts, and incremental cycle times.

No personally identifiable information (PII) is transmitted by the CVe Monitor.

Press Module

A Press Module is a small piece of equipment attached to a press in your plant. It physically connects to a CVe Monitor and wirelessly connects to a Gateway. Monitor to Gateway communication is performed using the Zigbee protocol (IEEE 802.15.4) over one or more unlicensed ISM bands. Information transmitted over the air is encrypted in transit.

Progressive Components uses radio modems developed by Digi International for wireless communication from a Press Module to a Gateway. Digi is an industry leader in the realm of remote monitoring and their hardware is used by other industries for transmitting sensitive financial information.

Digi radio modems transmit using FSK modulation while hopping among 25 unique frequencies in a pseudo-random sequence. This proprietary frequency hopping spread spectrum (FHSS) technique cannot be intercepted by other commercial radios on the market. In addition to FHSS, Digi uses a proprietary modulation technique that is not published anywhere. With no documentation or information publicly available, it would require sophisticated, expensive equipment to record and analyze a Press Module to Gateway wireless transmission.

Press Modules and Gateways support 128-bit AES (Advanced Encryption Standard) encryption to encrypt data on a ZigBee network.

No personally identifiable information (PII) is transmitted by a Press Module.

In plants with several ZigBee networks in place, a Press Module utilizes the Personal Area Network (PAN) identifier to uniquely identify the network.

Gateway

A Gateway device is a bridge between a Press Module and DigiCloud. A Gateway can connect and transmit to an external system using SSL tunnels, SSHv2 and/or FIPS 197 (IPsec, HTTPS)

No personally identifiable information (PII) is transmitted by a Gateway.

Version 4 hardware

Version 4 hardware consists of a CVe Monitor, optional repeaters, and a Gateway. Version 4 hardware connects directly to the ProFile System without the use of DigiCloud.

CVe Monitor

A CVe Monitor is a small piece of hardware directly attached to a mold in your plant. A Monitor aggregates cycle time, cycle count, temperature, and other information about the state of the tool it is attached to. Information is stored on the monitor and is also transmitted wirelessly using Bluetooth Low Energy (BLE) to a Gateway device, either directly or through a repeater.

A secure connection is setup over BLE using a long-term key that is exchanged during the first connection, known as BLE Pair and Bond. This key is used to encrypt the connected channel between the BLE gateway or mobile application and the CVe device.

Once a tool is cycling, a monitor transmits information relevant to the current operation of the tool, including but not limited to: serial number, battery level, device temperature, cycle count, and timestamps reflecting the mold operation. A monitor can also send high-priority messages alerting on events crossing user-defined thresholds, including temperature, cycle time, shock (rapid movement), and monitor disconnection to the tool.

A CVe Monitor pairs to a Gateway or Repeater over Bluetooth Low Energy with the strongest signal strength. The connection is maintained automatically and without operator intervention.

No personally identifiable information (PII) is transmitted by a CVe Monitor.

Repeater

A Repeater is a Bluetooth device which receives signals from CVe Monitors and Gateways and rebroadcasts them to extend the effective range of the network in the local plant environment.

There are no user-configurable properties of the repeater.

No personally identifiable information (PII) is transmitted by a repeater.

Gateway

A Gateway device is a bridge between the Monitors or Repeaters and the ProFile system. A Gateway communicates over HTTPS to the ProFile system.

No personally identifiable information (PII) is transmitted by a Gateway.

Cloud-based Systems

DigiCloud

Digi International administers the DigiCloud platform, where data is aggregated from the Gateways at your plants.

DigiCloud maintains the following security policy: the Device Cloud security policy is based upon a control matrix developed to support the standards set forth by the National Institute of Standards and Technology (NIST), ISO/IEC 27002, North American Electric Reliability Corporation – Critical Infrastructure Protection (NERC-CIP) and the Cloud Security Alliance (CSA). Device Cloud security technologies and processes prevent, detect, respond to and audit cyber threats on a continuous basis.

No personally identifiable information (PII) is stored in DigiCloud.

ProFile System

ProFile is hosted in the United States on Amazon Web Services (AWS). Controls are in place to protect the physical and virtual environment. Data is stored in data centers complying with SOC 1 Type 2 and SOC 2 Type 2 certifications, at minimum. For more information about AWS's security model, visit their website: https://aws.amazon.com/compliance/soc-faqs/.

ProFile is a multi-tiered system consisting of web, application, and database servers. Data is encrypted at rest and in transit using TLSv1.2 or higher. Data is stored in a scalable and highly available database server. Network controls limit connections to authorized services and sources.

ProFile is actively monitored for utilization, performance, uptime, and security vulnerabilities. Alerts and unauthorized access are sent to a team of engineers to triage and respond. Uptime is monitored by external systems. Systems are hardened against common vulnerabilities and regularly reviewed for evidence of compromise.

Local data in ProFile and its database are backed up on a daily, weekly, and monthly basis. Backups are encrypted in transit and at rest. Database backups are regularly tested to ensure availability.

The ProFile system stores and processes a user provided name and email address of all users in the system. The name and email address are provided by the local enterprise administrator.

Accounts are locked after several failed login attempts.

Sessions expire no more than 8 hours after creation.

Passwords must be complex, consisting between 10 and 128 characters including letters and numbers.

Client data is segregated within the ProFile system using logical identifiers. Clients are unable to identify or access other client information in the ProFile system.