Industrial Data Gateway Filtering for Secure Automation Traffic
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Industrial automation systems face challenges in ensuring reliable, traceable, and controllable data communication while preventing the leakage of sensitive operating data, particularly in message traffic with numerous but short messages, which can lead to production failures and downtime.
Innovation Solution
A gateway system that classifies and filters data streams based on information security criticality, performs aggregation, and provides warnings and digital attestations to ensure only agreed data is transmitted, using end-to-end encryption and monitoring to block or alarm on unauthorized data flows.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If data streams are transmitted without classification and filtering, then data communication speed is improved, but information security criticality deteriorates and sensitive data leakage occurs
Solution Approach 1:
The gateway segments data streams into different categories based on their information security criticality. The system divides all data streams into at least two groups: those requiring transmission and those that should be blocked or alerted. This segmentation allows the system to maintain high communication speed for authorized data while ensuring security for sensitive information.
Solution Approach 2:
The gateway acts as an intermediary component between automation devices and external systems. It receives data streams from automation devices, classifies them based on security criticality, and makes decisions about transmission, blocking, or alerting. This intermediary position enables the system to maintain both speed and security by filtering data before it reaches external systems.
2Quantity of substance
If numerous short messages are transmitted, then data communication volume is improved, but communication reliability deteriorates due to unwanted repetition and incomplete transmissions
Solution Approach 1:
The gateway performs preliminary classification and filtering of data streams before transmission. By pre-determining which data should be transmitted and which should be blocked or alerted, the system prevents unwanted repetition of transmissions and ensures complete transmission of critical data, thereby improving reliability without reducing communication volume.
Solution Approach 2:
The system implements feedback mechanisms where the gateway monitors transmission outcomes and can alert operators when data streams are blocked or when transmission issues occur. This feedback loop ensures that communication reliability is maintained by allowing corrective actions when problems arise, while still permitting high-volume data communication to proceed normally.
3Reliability
If data filtering and aggregation are performed, then information security criticality is improved, but device complexity increases
Solution Approach 1:
The gateway is designed as a multi-functional device that performs classification, filtering, aggregation, and monitoring of data streams. By consolidating these functions into a single gateway component, the system achieves high information security criticality without proportionally increasing overall system complexity. The gateway handles multiple tasks that would otherwise require separate systems.
4Reliability
If end-to-end encryption is implemented, then information security criticality is improved, but communication speed deteriorates
Solution Approach 1:
The gateway segments the data processing pipeline into distinct stages: data reception, classification, filtering, encryption, and transmission. By separating these functions and processing them sequentially rather than simultaneously, the system maintains encryption security while minimizing speed penalties. Non-critical data can be processed more quickly while critical data receives full encryption treatment.
Data Source
AI summary
Method and gateway for data communication between automation devices of an industrial automation system and a computer system via a wide-area network, wherein automation devices provide measurement or state variables at respective data points via a first interface of the gateway that includes a second interface for forwarding data streams respectively assigned to the data points to the computer system and that creates a first classification each data point in accordance with information security criticality of the data streams proceeding from there, where based on the associated first classification and an associated predefinable filtering or aggregation, the gateway in each case creates a second classification in accordance with the information security criticality, and in the event of at least a prior attempt to forward the data streams to the computer system, the gateway, in line with the associated second classifications, creates warnings formed from the associated second