Secure Access Hub for VPN Bridging of CPS and Enterprise Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cyber-physical systems (CPS) lack integrated security measures during their lifecycle, leading to vulnerabilities in network communication, requiring manual and resource-intensive management, and are often isolated from enterprise networks, necessitating time-consuming manual updates and configurations.
Innovation Solution
A Secure Access Smart Hub (SASH) system that establishes secure virtual private networks (VPNs) between CPS devices and enterprise networks, translating protocols and providing network layer security using IPSec, acting as a gateway to bridge enterprise and CPS networks, and offering firewall protection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If CPS networks are isolated from enterprise management networks for security reasons, then security against traffic eavesdropping and manipulation is improved, but the ability to perform centralized configuration, maintenance, and updating is worsened
Solution Approach 1:
The patent introduces a network gateway as an intermediary device that bridges the isolated CPS network and the enterprise management network. The gateway establishes secure VPN connections to both networks, enabling centralized configuration, maintenance, and update operations while maintaining security isolation. This mediator allows remote management without direct network exposure.
2Reliability
If manual configuration and updates are performed on hundreds to thousands of CPS devices, then device security and functionality are maintained, but time investment and operational effort increase enormously
Solution Approach 1:
The patent implements automated self-service mechanisms where CPS devices can be remotely configured, updated, and maintained through the network gateway without requiring physical access or manual intervention at each device location. The system enables automated firmware updates, configuration changes, and security patch deployments across thousands of devices simultaneously.
3Reliability
If traditional virus scanning software is deployed on CPS devices, then malware detection capability is improved, but hardware and software requirements are not met by typical CPS devices
Solution Approach 1:
The patent extracts the security scanning functionality from the CPS devices themselves and relocates it to external servers or cloud-based security platforms. The network gateway facilitates this extraction by acting as a secure interface, allowing CPS devices to receive security updates and malware protection without requiring them to run complex scanning software locally.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Systems and methods are disclosed for providing a secure communication between a first network and a second network. The method may include receiving, at a Secure Access Smart Hub (SASH), a signal from the first network requesting a communication connection; establishing a first connection between the first network and the SASH; establishing a second connection between the SASH and the second network; receiving, at the SASH, data from the first network having a first protocol; translating the data having the first protocol into data having a second protocol; and transmitting the data from the SASH to the second network.