Zero Trust Proxy Architecture for Deterministic OT Data Transmission
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Industrial automation systems face challenges in ensuring both data security and deterministic data transmission, particularly in communication between IT and OT systems, where zero trust concepts complicate deterministic behavior and perimeter-based security solutions are inadequate.
Innovation Solution
A two-stage protection concept is implemented, with OSI layer 2 communication ensuring determinism and OSI layers 3-7 using zero trust proxies for enhanced security, involving switches that authenticate and filter data traffic, and zero trust proxies for session-based authentication across networks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If zero trust concepts are implemented for enhanced security in OSI layers 3-7, then data security is improved, but deterministic data transmission behavior deteriorates
Solution Approach 1:
The communication system is segmented into two distinct layers: OSI layer 2 handles time-critical deterministic communication with guaranteed transmission behavior, while OSI layers 3-7 implement zero trust security concepts. This segmentation allows each layer to optimize for its specific function without compromising the other.
Solution Approach 2:
A gateway system acts as an intermediary between the deterministic layer 2 network and the zero trust layer 3-7 network. The gateway translates and mediates communications between these two domains, allowing security checks to occur without disrupting the deterministic timing characteristics of industrial automation traffic.
2Reliability
If perimeter-based security solutions are used to protect industrial automation systems, then security boundaries are established, but they become inadequate for modern IT-OT convergence challenges
Solution Approach 1:
The system transitions from traditional perimeter-based security (single dimensional boundary protection) to a multi-layered security architecture that operates at both OSI layer 2 and layers 3-7 simultaneously. This adds dimensional depth to security protection, creating nested security zones that are better suited for complex IT-OT converged environments.
3Reliability
If network layer communication is authorized only between authenticated system components, then security is improved, but network complexity increases
Solution Approach 1:
The gateway system performs multiple functions simultaneously: it acts as an authentication server, a firewall, a protocol translator, and a network address translator. By consolidating these functions into a single universal component, the system achieves strong security authorization without proportionally increasing overall network complexity.
Data Source
AI summary
A method for securely transmitting time-critical data within a communication system including local networks in which data are transmitted via switching, at least one network superimposed with respect to the local networks, in which data are transmitted via routing, and a gateway system for connecting the communication system to an unsecured external network, wherein network layer communication via the superimposed network is authorized only between authenticated system components, switches authenticate connected terminal devices and assign these to a physical or logical local network in accordance with a respective terminal device identity, security layer communication is authorized within the local networks implicitly based on an assignment of respective terminal devices to the same local network, communication at OSI layer 3-7 between terminal devices of different local networks or with terminal devices in the unsecured external network is authorized via zero trust proxies that are each assigned to a local network.