English is currently available.
Industrial IoT DISCUSSION
Production wants machine data in a cloud analytics service. At the moment the PLCs, HMIs and drives are on one flat network that has no connection to anything else. The simplest proposal on the table is to give the PLC network a route to the internet through the office router.
That feels wrong to me, but I cannot explain clearly what the accepted architecture is. How should the data get out while the controllers stay protected?
The instinct is right. Most PLCs and drives were designed for a trusted network: Modbus TCP and the older versions of several vendor protocols have no authentication, so anything that can reach the controller's port can read and usually write. A flat network with a route to the internet means a single compromised office PC, or one wrongly forwarded port, reaches every controller.
The accepted approach is segmentation. The control network stays a separate zone, and traffic between zones passes only through defined conduits with firewall rules. This is the zone and conduit model of IEC 62443, and the layered picture usually drawn as the Purdue model.
In practice you place an edge gateway with two network interfaces: one in the control network, one in an intermediate zone (an industrial DMZ) between the control network and the office network. The gateway polls the PLCs with read-only access and publishes outward. The firewall rules then become very short: the gateway may open an outbound TLS connection to one named cloud endpoint on one port, and nothing may open a connection inward. No port forwarding, and no public IP address on anything in the plant.
Because the connection is initiated from inside, the cloud service can still reply on it, but an outside party cannot start a conversation with the gateway or the PLCs.
Make the read-only property real rather than assumed. Use the controller's access protection where it exists, give the gateway an account or connection type without write rights, and for Modbus devices consider a gateway or firewall that filters by function code and passes only the read functions. Disable IP routing on the gateway itself so it cannot act as a bridge between its two interfaces.
If the requirement is strictly one-way flow, data diodes exist for that: hardware that physically allows transmission in one direction only. They are used in power and other critical infrastructure and are usually more than a machine-data project needs.
Remote access for maintenance is a different requirement and should not ride on the data path. If a vendor needs to reach a PLC, use a VPN that terminates in the DMZ, with individual accounts, multi-factor authentication, access enabled only for the agreed time window, and a jump host from which the session continues. An always-on remote access box placed directly in the machine network undoes the segmentation.
Finally, keep an inventory. List every device, firmware version and open service in the control network, and change default passwords on HMIs, switches and gateways. Ordinary weaknesses such as a default credential are a far more likely way in than anything exotic.
Back to Industrial IoT community
