Production Machine Data Diodes for Secure One-Way Connectivity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing solutions for data-secure connections of manufacturing machines to external data processing devices lack robustness against access from third parties, leading to potential adverse effects on product manufacturing due to security gaps and incorrect configurations.
Innovation Solution
A multi-zone information processing system connected by data diodes, where each zone has varying data security levels, allowing unidirectional data flow from higher to lower security zones, ensuring read-only access to external devices and preventing write access to critical data, thereby enhancing operational reliability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a manufacturing machine is directly connected to an external data processing facility, then information exchange capability is improved, but security against unauthorized access deteriorates
Solution Approach 1:
The system is divided into multiple security zones (zone 1 with highest security to zone 4 with lowest security), where each zone has progressively lower security requirements. This segmentation allows the manufacturing machine to exchange information with external facilities while maintaining security boundaries that prevent unauthorized access to critical systems.
Solution Approach 2:
Data diodes are introduced as intermediary components between security zones to enable controlled information flow. These unidirectional transmission media act as mediators that allow data to pass from higher security zones to lower security zones while preventing any reverse flow, thus eliminating the risk of unauthorized write access to the manufacturing machine.
2Object-affected harmful factors
If access control measures are implemented to prevent unauthorized access, then security is improved, but operational reliability may deteriorate due to potential false security measures
Solution Approach 1:
The system converts the potential harm of security measures affecting operational reliability into a benefit by using data diodes that provide absolute security through their unidirectional nature. The physical constraint of the data diode ensures that security measures cannot possibly interfere with manufacturing operations, as they only allow data flow in one direction away from the manufacturing machine.
3Adaptability or versatility
If data is transmitted bidirectionally between manufacturing machine and external devices, then functionality is improved, but risk of write access to critical data increases
Solution Approach 1:
The system implements asymmetric data flow where data can be transmitted from the manufacturing machine to external devices but not vice versa. Data diodes create an asymmetric communication channel that allows full functionality for data transmission while eliminating the possibility of write access to critical manufacturing data through the unidirectional nature of the transmission medium.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The invention relates to a device for linking at least one production machine (104) in a data-secured manner, comprising an information-processing system (114) which is divided into individual zones (108, 110, 112) connected together by data diodes (120) such that data originating from the machine controller (118) of the production machine (104) in a data flow can be transmitted to other zones (108, 110, 112) without the possibility of data feedback, said zones being ordered in a hierarchical manner such that each zone has less data security than the preceding zone (108, 110) in the data flow. Each zone (108, 10, 112) is designed as an isolated solution in the form of an autonomous computer. The invention additionally relates to a production machine and to an industrial system.