Secure Firmware Signing Workflow Diagram (DXF)

This DXF resource operationalizes cryptographic assurance principles—specifically code signing, chain-of-trust establishment, and secure key management—tailored to the constrained, safety-critical environments of mining automation infrastructure. It maps standardized workflow stages: firmware build and hashing, offline private key signing using Hardware Security Modules (HSMs), certificate-based attestation (e.g., X.509 PKI), secure distribution via signed manifests, and runtime verification on edge devices (e.g., PLCs, RTUs, or autonomous haul trucks). The diagram explicitly separates trusted (air-gapped signing environments) and untrusted (OT network, cloud update servers) zones, annotates cryptographic algorithms (e.g., ECDSA P-384, SHA-384), and defines validation checks such as signature verification, certificate revocation status (OCSP/CRL), and firmware image hash matching. As part of the Mine Automation Cybersecurity Framework, it aligns with IEC 62443-3-3 SL2 requirements for secure software update mechanisms and supports auditability, incident response forensics, and regulatory reporting by providing a machine-readable, version-controlled visual specification.