E.5 Adding / removing / replacing Components into a configured Vending Machine

When a component should be added to an existing Vending Machine it needs to be added to the certificate group by the GDS or specialized application. This does not require access by the GDS to the other components of the Vending Machine, i.e., this could be done on a workbench before the technician travels to the location of the Vending Machine. By signing the certificate, the new component will be accepted as communication partner from the other components of the Vending Machine.

When a component gets removed from the Vending Machine, ideally it should be removed from the certificate group and therefore be added to the CRL, while the lifetime of the signed certificate is still valid. This requires, that the GDS or specialized application has access to all the other components of the Vending Machine. This is the most secure option. Alternatively, the component gets reset and the reset reliably removes the certificate (including the private key) from the component. If this process is trusted, the component can be removed and reset in order to disable it talking to the other components of the Vending Machine. If the component gets removed because it is broken and cannot be reset, the memory section should be physically destroyed in order to avoid security risks.

Replacing a component is combining adding and removing a component, so the above text can be applied.