Industrial VPN Connection Using Token-Based Device Provisioning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Establishing secure remote connections to industrial devices in industrial environments like Industry 4.0 or IIoT environments is challenging due to security vulnerabilities and complexity in existing solutions, which often require additional hardware and network configurations, and are prone to attacks.
Innovation Solution
A method involving the creation of a virtual private network (VPN) with configuration information stored on devices, using tokens to transfer configuration data securely, and establishing connections through these tokens to ensure secure communication between industrial and remote devices, with configurable lifetimes to enhance security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional security mechanisms are implemented for outbound connections, then security is improved, but device complexity and costs increase
Solution Approach 1:
The patent extracts the security validation logic from the cloud application and places it directly in the industrial device. The device independently validates incoming connection requests against stored authorization data, eliminating the need for complex cloud-based authentication mechanisms and reducing connection establishment complexity while maintaining security.
Solution Approach 2:
The industrial device performs self-authentication by validating connection requests against locally stored authorization information. This self-service approach eliminates dependency on complex external authentication systems, reducing both device complexity and connection setup overhead while maintaining reliable security.
2Ease of operation
If cloud applications are used for device registration and connection management, then connection functionality is improved, but vulnerability to attacks increases
Solution Approach 1:
Instead of having the cloud application validate and authorize connections, the patent inverts the approach by having the industrial device independently validate incoming requests against locally stored authorization data. This inversion removes the cloud application as a security vulnerability point while maintaining connection management functionality.
Solution Approach 2:
The patent introduces cryptographic tokens as an intermediary mechanism. These tokens contain pre-shared authorization information that mediates between the cloud application and industrial device, allowing secure connection management without requiring the cloud application to be directly involved in real-time authentication, thus reducing attack surfaces.
3Adaptability or versatility
If additional hardware and third-party software are deployed, then remote access capability is improved, but system complexity increases
Solution Approach 1:
The patent makes the industrial device itself multi-functional by enabling it to directly receive, validate, and establish secure connections without requiring additional hardware like iPCs or external software like TeamViewer. The device's built-in processing capabilities are sufficient for remote access, eliminating extra hardware requirements while maintaining versatility.
4Ease of operation
If site-to-site VPN connections are established, then network connectivity is improved, but network security control becomes more difficult
Solution Approach 1:
The patent applies local quality by having each industrial device independently validate connection requests against its own specific authorization data. Instead of a blanket VPN that exposes entire networks, each device controls access to its own resources based on locally stored authorization information, maintaining connectivity while preventing unauthorized information exposure.
Data Source
Figure 1
Figure 2
AI summary
A method for establishing a secure connection between an industrial device and a remote device, wherein one of the industrial device and the remote device is referred as a first device, and the other one of the industrial device and the remote device is referred as a second device, the method comprising: creating a virtual private network, VPN; storing a first configuration information of the VPN for the first device; storing a second configuration information of the VPN for the second device; connecting the first device to the VPN based on the first configuration information; creating at least one first token that includes the second configuration information; transferring the second configuration information to the second device through the at least one first token; connecting the second device to the VPN based on the second configuration information transferred through the at least one first token; communicating between the first device and the second device via the VPN.