Secure Remote Access to Historical Data via DMZ Tunneling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current technologies face challenges in securely and reliably exchanging real-time and historical data between industrial control systems (ICS) and information technology (IT) networks, particularly due to security concerns and the need for direct internet access, which exposes systems to potential attacks and compromises network isolation.
Innovation Solution
The implementation of a secure network architecture that uses a DMZ (de-militarized zone) to facilitate secure communication between historians, employing pull replication and daisy chaining of historical data, and leveraging WebSocket connections to transmit data over HTTP or HTTPS, thereby reducing attack surfaces and eliminating the need for open inbound firewall ports.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If direct internet access is implemented to enable data exchange between ICS and IT networks, then communication reliability is improved, but security risk increases due to exposure to external attacks
Solution Approach 1:
A DMZ (de-militarized zone) network is introduced as an intermediary layer between the ICS network and the IT network. The DMZ contains historians that receive data from ICS systems and make it available to IT systems, thereby enabling communication while preventing direct access and reducing security risks to the ICS network.
Solution Approach 2:
The network architecture is segmented into three distinct zones: the ICS network, the DMZ, and the IT network. This segmentation isolates the ICS network from direct internet exposure while allowing controlled data flow through the DMZ, thus maintaining both communication reliability and security.
2Ease of operation
If open inbound firewall ports are configured to allow external access, then ease of operation is improved, but security risk increases due to exposed attack surfaces
Solution Approach 1:
Instead of allowing inbound connections from the IT network to the ICS network, the architecture inverts the connection direction. ICS systems initiate outbound connections to historians in the DMZ, which then make data available to IT systems. This inversion eliminates the need for open inbound firewall ports while maintaining accessibility.
Solution Approach 2:
The DMZ historians act as intermediaries that receive data from ICS systems and serve IT systems. This intermediary approach allows IT systems to access historical data without requiring direct inbound access to the ICS network, thereby reducing the attack surface while maintaining ease of operation.
3Object-affected harmful factors
If network isolation is maintained to protect ICS systems, then security is improved, but data exchange capability deteriorates
Solution Approach 1:
The DMZ historians serve as intermediaries that enable data exchange between the isolated ICS network and the IT network. The historians receive real-time and historical data from ICS systems and make it available to IT systems, thus maintaining network isolation while providing robust data exchange capability.
Solution Approach 2:
The architecture adds a new dimension to the network topology by introducing the DMZ layer. This additional layer enables data exchange functionality that would otherwise require direct network connectivity, thus improving data exchange capability while maintaining the security benefits of network isolation.
Data Source
AI summary
Methods, systems, and computer products facilitate access to historical data via a real-time tunnel within an architectural framework that encompasses an operational technology (OT) network, a de-militarized zone (DMZ), and an information technology (IT) network. Real-time data is retrieved from a data source using a first connector, which comprises a first tunneller, a first history-writer, and a first history-tunneller. The mechanisms involve interleaving real-time data and historical data over a first tunnel connection, a first firewall, and a second firewall by (a) executing pull replication of the historical data, (b) daisy-chaining the historical data, or (c) a combination of both (a) and (b). Subsequently, the real-time data is written to the first tunneller.