Uni-Directional Data Interfaces for Secure Industrial Rule Updates
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Industrial systems face risks such as unauthorized data transmission, system malfunction, and data misuse due to the separation of data collection and processing, particularly when using cloud-driven analytics, where data pre-processing can become inefficient if rules for data selection and target identification are complex to modify.
Innovation Solution
A computer system with a data collection server and uni-directional interfaces, one for data transmission and another for receiving control instructions, allowing rule modifications while maintaining data security through size limitations and secure communication channels, such as a data diode and air-gap interactions with mobile data carriers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data pre-processing uses rule-based data selection and target identification, then data security and risk mitigation are improved, but rule modification becomes complicated and efficiency decreases
Solution Approach 1:
The system separates data transmission and rule modification into two distinct uni-directional interfaces: one for data flow and another for control instructions. This segmentation allows rule modifications to be made through a dedicated control channel without compromising the security of the main data transmission path, resolving the contradiction between maintaining security and enabling operational flexibility.
Solution Approach 2:
The patent introduces an intermediary control interface that mediates between the analysis system and the data collection server. This intermediary allows rule modifications to be transmitted as control instructions without direct bidirectional communication, maintaining security while enabling rule changes. The intermediary acts as a controlled gateway that permits rule modification requests while blocking unauthorized data access.
2Reliability
If uni-directional interfaces are used for data transmission, then data security is improved, but counter-directional communication for rule modifications is restricted
Solution Approach 1:
The system adds another dimension to communication by introducing a separate control interface specifically for rule modifications. Instead of relying on bidirectional communication in the data transmission channel, the patent creates a parallel communication dimension for control instructions. This allows rule modifications to occur without compromising the uni-directional security model of the main data channel.
Solution Approach 2:
The control interface serves multiple functions: it receives control instructions, transmits rule modification requests, and maintains the security architecture. By making this interface multi-functional, the system enables both secure data transmission and adaptable rule modification through a unified security framework, resolving the contradiction between security and versatility.
3Reliability
If data is transmitted partially to multiple analytics systems, then risk mitigation is improved, but network traffic increases without guaranteed data analysis
Solution Approach 1:
The data collection server performs preliminary rule-based data selection and filtering before transmission to multiple analytics systems. By pre-processing data according to predetermined rules, the system ensures that only relevant data subsets are transmitted to each analytics system. This preliminary action reduces unnecessary network traffic while maintaining risk mitigation through selective data distribution.
Solution Approach 2:
The system applies consistent rule-based filtering across multiple data transmission paths to ensure uniform data quality and relevance. By maintaining equipotential data selection criteria, the system optimizes network traffic across all analytics systems while ensuring each receives appropriate data subsets, balancing risk mitigation with energy efficiency.
Data Source
AI summary
A computer system for communicating with an industrial system includes: a data collection server for receiving equipment data from the industrial system and providing a data stream by pre-processing the equipment data according to a plurality of pre-determined rules; a first uni-directional interface for transmitting the data stream to one or more further computer systems; and a second uni-directional interface for receiving a data packet from the one or more further computer systems, the data packet including a control instruction that allows a modification of at least a particular rule of the plurality of the pre-determined rules. The first uni-directional interface includes a data diode. The second unidirectional interface receives the control instruction in a first part of the data packet. The first uni-directional interface receives the first part of the data packet in a size limitation that corresponds to amounts of data required to identify the modification.