Remote Access and Monitoring of Connected IoT Assets

Editor's Notes

• #7: We understand the industry challenges and market drives that you are facing. Whether it is a challenge in finding the right skills or not having enough resources, challenges to increase plant performance, accelerate your time to market or address IT/OT challenges, we are here to help.
• #9: The Connected Enterprise paves the way to get remote connectivity to your critical assets for maintenance, troubleshooting, collaboration, and remote monitoring. <CLICK> With the help of gateway HW/SW, secure communications can occur to cloud-enabled devices. <CLICK> This communication is outbound only to specific device addresses. Connectivity to these devices is securely enabled by a corporate network (and its firewall) or a cellular connection in more remote areas. <CLICK> Having multiple entry points into your plant increases risks. Having one common secure remote access platform limits those risks by limiting entry points, securing the connection, control access to individual devices based on user and providing a record of who accessed your plant, when, and what did they do. <CLICK> This is a platform that’s provided by Rockwell Automation as a service. <CLICK> As part of the service, Rockwell Automation will provide SW/HW, and perform the configuration, deployment, administration, and support.
• #10: All communication to cloud server is authenticated Interactive authentication model for users Federated / Claims based security model Cookie provided by designated Claims provider Cookie in user’s browser to verify authentication for all api calls Access token model for devices (Gateways) Shared Access token server (Troll Bridge) Verifies that device requesting token is known to server (Key & Secret) Upon successful verification token and target endpoints are returned to gateway. All Traffic is redirected to https All device Traffic (Gateways) uses port 443 and is outbound only __________ Customer portal Pluggable framework for hosting and deploying offerings Subscription and identity management capabilities User notifications and preferences Device and application management Updates across many devices Deployment of subscribed content Telemetry and usage analysis End to end security from devices Role based security and policy management Remote access
• #11: Physical Facilities State-of-the-art security and access control. 200+ services delivered 24/7 Leading innovator in power efficiency 2,000+ people in engineering and operations.$2.3B+in cloud infrastructure Geo-Distribution Multiple data centers in different geographies Local and geo-replication Redundant platform services and failover Platform Availability and Security 99.9% uptime, financially-backed SLAs Highly available platform services Service isolation over virtualized compute and network Clear boundaries and multiple lines of defense Compliance and DR Physical facilities have broad compliance certifications Service-level compliance on near-term roadmap Preparedness, testing, refinement
• #12: Getting Connected enables a single point of data collection. Secure remote access connection allows remote workers to securely access predefined assets using their native software to remotely access electronic operator interfaces, design and maintenance tools. Through our “Connect” platform, you can securely access any of your devices or assets for design, maintenance and troubleshooting.
• #14: A remote access platform allows for key stakeholders to have access to critical assets to improve productivity and reduce downtime. Focus on end users. Remote Workers – key technical staff that may not be on-site (off-hours) OEMs – Allow OEMs ability to remotely diagnose and troubleshoot issues. Rockwell Automation Application Support – Supplement on-site staff with Rockwell Automation experts who are trained on the application and support 24x7
• #16: How do personas positively and negatively interact - can we resolve current conflicts - i.e. end user operations and IT/OT How do our solutions resolve these conflicts - graphic to show cooperation (green) or conflict (red) - how do we turn red arrows green (mitigate conflict/risk) Market problems - what are we solving - What do we want to solve going forward
• #18: The Secure Remote Access is a two component solution providing secure remote access and system level monitoring. The first is the Secure Remote Access software agent and the second is the web site application known as the Service Center. The onsite component is a software agent deployed to a virtual image stack, installed on a local computer, or preloaded on an industrial PC and shipped to the site. The VSE only requires an outbound only ( i.e. one way firewall rule from the plant to the Internet) connection, thus all incoming unwanted traffic is still blocked. Once deployed the VSE established a connection (via continuous TCP Socket) to the Service Center. It will send continuous heartbeats to the SC with information regarding its health and if there are any requests (such as remote access) the VSE needs to perform. Since the Internet conversation was initiated by the VSE, the onsite firewall allows a return conversation from the Service Center maintaining the security. On-site the VSE is connected to the plant network, either logically via routing or separate Ethernet ports on the physical PC. This will allow the VSE to manage remote access connections and gather system information if alarm monitoring is used. The Service Center runs the Website application which provides the portal to remote access allowing an authenticated user to utilize the system from anywhere and anytime.
• #19: The Secure Remote Access solution does not use VPN for remote access, instead system utilizes Secure Socket Layer (SSL) Tunneling initiated at the site by the VSE and brokered through the Service Center system. A user must therefore select the exact device and protocol fro remote access via the Service Center website. When a user needs remote access, as in this example to the PanelView HMI, they first log on to the Service Center website and select the HMI from the list of devices for that VSE and ask the Service Center to initiate a remote access session using VNC (the remote access protocol supported by the PanelView HMI) When the VSE sends its next heartbeat to the Service Center, the SC will instruct the VSE to create a remote access session to the Panelview using the chosen protocol, VNC. Once this session is created it will instruct the Service Center it is ready for the user to take the next step The Service Center alerts the user who initiates the creation of an SSL tunnel brokered by the SC . When complete the VNC session on the VSE PC is echoed through the tunnel and displayed on the users PC inside an applet. Based on permissions the user can have complete control over the HMI as if they were standing in front of it Many other protocols for remote access such as RDP, HTTP, Telnet, SSH, FTP, and RSlinx are available. Support of direct Point-to-point connections (such as competitors PLC programming software) are also available. Can connect to virtually any device, RA or third party, that connects via Ethernet. - i.e. Drives, PLC, applications, databases, network components
• #20: Rockwell Automation’s Secure Remote Access Platform complies with the CPwE, also knows as the Purdue Model architecture. This is the reference architecture that Rockwell Automation is using to guide our customers towards IT/OT convergence. CPwE - Defined The core of Converged Plantwide Ethernet (CPwE) Architectures is this Logical Framework. That is, Network Segmentation – segmentation for the purpose of traffic management, and segmented policies such as security and QoS. This segmentation is organized into levels and zones. Segmenting network services such as Quality of Service, or QoS, Virtual LANS, or VLANs, and Multicast traffic. These services exist in both the Enterprise and Industrial Zones, and should be segmented. The Industrial Demilitarized Zone – or IDMZ – is used as a barrier between the Enterprise Zone and Industrial Zone – the IDMZ concept is common in IT, but it’s a new concept in Industrial applications. Primary goal is to provide an indirect network path between the Enterprise and Industrial Zone via managed devices. One of these managed devices is the VSE that hosts the local remote access agent. Industrial Zone Best Practices Replicate critical services in the industrial zone, consider the following: Domain Services e.g. LDAP or Active Directory Naming services e.g. DNS & WINS IP Address services e.g. DHCP Time services e.g. NTP or PTP Availability: apply redundant network routers/switches and links to maintain overall network availability Scalability: small sites use combined core and distribution switches, larger or growing sites should separate to avoid oversubscription on uplinks. Deploy Security and Network Management Routing: Use link-state routing protocols or EIGRP for Layer 3 load balancing and convergence Use EIGRP to simplify configuration If standard protocols are required, use OSPF No overlapping IP addresses with enterprise network.
• #21: The Connected Enterprise paves the way to get remote connectivity to your critical assets for maintenance, troubleshooting, collaboration, and remote monitoring. Having multiple entry points into your plant increases risks. Having one common secure remote access platform limits those risks by limiting entry points, securing the connection, control access to individual devices based on user and providing a record of who accessed your plant, when, and what did they do. This is a platform that’s provided by Rockwell Automation as a service. As part of the service, Rockwell Automation will provide SW/HW, and perform the configuration, deployment, administration, and support. Secure Communications Outbound only to specific IP address(es) [Firewall rule] Two way authentication (1024 bit ) to ensure connection is between the VSE and Service Center Encryption (Secure Socket Layer [SSL] V3.0 and Transport Layer Security [TLS] v1.0) Secure Tunnel to ensure no other entity can “listen in” User Access Control [Customer Name] specifies the devices that can be connected to and by whom [Customer Name] can approve each remote activity Audit and Traceability Operational log that maintains a detailed record of all remote activity Audit log of new user creation and permission modification Recording of all desktop sharing sessions conducted via VNC
• #22: Get Informed by collecting asset performance data, machine health and device health data. Contextualize the data into dynamic dashboards and reports with the option to modify or create other custom views of your data. Get notified when a particular data point reaches a predefined threshold allowing you to be more proactive to situations that may impact the performance of your operations. Through our “Collect” platform you can visualize the health of individual assets or your entire system through customized dashboards and reports. Get notified when certain data points reach a predefined threshold and archive data and other information in the event there is a catastrophic failure.
• #23: Value-driven solutions may not all look the same on paper. Custom Cloud Services solutions from Rockwell Automation enables increased flexibility to best support your needs. A custom combination of our portfolio offering aims to be unique - just like our customers, their industries, their applications, and their critical assets.
• #26: Critical assets can be found just about anywhere in a plant or application, and often times they are not device-specific. The team of experts behind the Remote Monitoring and Analytics portfolio can frame, develop, and deploy solutions to fit a variety of customer needs. This team have deployed custom cloud solutions to the areas shows here.
• #27: Listing of the functions within monitoring and support as well as the methodologies for getting the data from the gateway to the cloud.