Secure front-end interface
View Patent ↗A secure front-end interface for a PLC, RTU or similar device is disclosed. A first server is coupled to the PLC via a communications link and is configured to receive status information from the device and transmit the information to a second server via a one-way data link. The second server has a network interface for coupling to a network and receives the information from the first server via the one-way data link and outputs the information via the network interface based upon a user request. The front-end interface may further include a second one-way data link coupled from the second server to the first server to allow user command entry. The secure front-end interface may alternatively consist only of a single server coupled between the device and the network which requires a user to enter a password before obtaining access to the status information.
1. A front-end interface for a device, comprising:
a first server coupled to a device via a dedicated communications link and having an output, the first server configured to receive information from the device and forward the information on the output;
a first one-way data link having an input coupled to the output of the first server and an output, the first one-way data link configured to allow information to pass from the input to the output and to prevent any signal from passing from the output to the input;
a second server having an input coupled to the output of the first one-way data link and a network interface for coupling to a network, the second server configured to receive the information from the device forwarded from the first server via the one-way data link, the second server further configured to output the information to a user via the network interface based upon a user request received via the network interface for the information from the device;
a second one-way data link having an input coupled to an output on the second server and an output coupled to an input on the first server, the second one-way data link configured to allow information to pass from the input to the output and to prevent any signal from passing from the output to the input,
wherein the second server is further configured to allow a user to enter a command for the device and to transmit the entered command to the first server via the second one-way device; and
wherein the first server is further configured to receive the command via the second one-way data link and transmit the received command to the device via the communications link.
2. The front-end interface of claim 1 , wherein the second server is configured to require that the user enter a password before allowing the user to select or enter the command.
3. The front-end interface of claim 1 , wherein the second server is configured to require that the user enter a password before allowing the user access to select or enter the command, wherein the command comprises one of a set of commands, wherein the user is assigned one of a predetermined set of roles, each role associated with a subset of the set of commands, wherein the second server is configured to restrict the user to be able to enter or select only commands within the predetermined subset of commands associated with the assigned role.
4. The front-end interface of claim 1 , wherein the device is one of a programmable logic controller (PLC), a Remote Terminal Unit (RTU), a network gateway, a network router, a network bridge, a network switch, a network hub, a network repeater or a sensor.
5. The front end interface of claim 1 , wherein the second server is coupled to the first server only via the first one-way data link and the second one-way data link.