Secure Remote Access for IIoT Devices via Gateway Tunnels
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional remote-access methods for industrial devices in the Industrial Internet of Things (IIoT) lack flexibility and security, particularly when connecting to legacy systems with unsecure protocols, making it difficult to manage access and ensure data protection.
Innovation Solution
A method involving a chain of trusted certificate-based point-to-point connections through intermediate gateways, using a reverse connection from a gateway to a target device, with access token validation via an identity and access management service, to establish secure tunnels for remote access without direct Internet Protocol connectivity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If traditional remote-access methods (VPN, RDC) are used to connect to industrial devices, then remote access capability is provided, but security risks increase and setup complexity increases
Solution Approach 1:
The patent introduces an Identity and Access Management (IAM) service as an intermediary between the user device and the industrial device. The IAM service validates access tokens and manages authentication, acting as a trusted mediator that enables secure remote access without requiring direct connections between user devices and industrial devices. This resolves the security concern by centralizing authentication control.
Solution Approach 2:
The patent segments the remote access system into distinct functional components: user devices, gateways, industrial devices, and an IAM service. Each component has a specific security role, with the IAM service handling authentication, gateways handling protocol translation and tunnel establishment, and industrial devices maintaining security boundaries. This segmentation allows security to be enforced at multiple levels rather than requiring a single complex security mechanism.
2Ease of operation
If direct Internet connectivity is provided to industrial devices for remote access, then ease of operation improves, but security risks increase due to exposure to unsecure protocols
Solution Approach 1:
The gateway acts as an intermediary between the Internet and industrial devices. It receives connections from user devices, validates access tokens through the IAM service, and establishes secure tunnels to industrial devices. The gateway translates between unsecure external protocols and secure internal communication, blocking direct access to industrial devices while enabling controlled remote access.
Solution Approach 2:
The patent introduces a new dimension of security by implementing encrypted tunnel connections between the gateway and industrial devices. Instead of allowing direct protocol communication, the system creates a separate secure communication channel (tunnel) that encapsulates and encrypts the data flow, effectively adding a security layer that transforms the communication dimension from direct/exposed to indirect/protected.
3Adaptability or versatility
If multiple legacy systems with different security zones are maintained, then compatibility with existing industrial devices is preserved, but system complexity increases
Solution Approach 1:
The gateway is designed as a universal multi-functional component that can handle multiple legacy protocols (SCADA, Modbus, etc.), translate between different security zone requirements, and establish tunnels to various types of industrial devices. The IAM service provides universal authentication across all devices and users. This multi-functionality reduces system complexity by consolidating protocol translation and security management in standardized components rather than requiring custom solutions for each legacy system.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Disclosed is a method for establishing a secure remote connection between a user device and a target device, wherein the target device has no direct internet connectivity. A first gateway receives a first connection request from the user device, said first connection request comprising an access token. The access token is validated in an identity and access management service, and, after successful validation, a first tunnel is established between the user device and the target device via one or more intermediate gateways. The target device receives a second connection request from the user device, said second connection request comprising the access token. A second tunnel is established between the target device and an identity and access management service via the one or more intermediate gateways, and the access token is validated in the identity and access management service via the second tunnel.