Industrial VPN Cloud Services. Paul A. Mercier Project Engineer PHOENIX CONTACT, USA

Transcription

1 Industrial VPN Cloud Services Paul A. Mercier Project Engineer PHOENIX CONTACT, USA

2 What does Phoenix Contact do? Connectors? Terminal Blocks? 2

3 Plus a whole lot more 3 Networking & Security Mariam Dec 2014

4 Intro How do you support your end customers? Car, train or plane to site No matter how you do it, the goal is to provide support Costs Sending technicians/engineers on site Plane ticket Rental car Hotel Meals Comp day Plus customer has to wait till travel arranged ~$1000 per service trip + opportunity cost 4

5 Intro Remote access to industrial equipment is not a new invention Dial up Modems: Each machine had a modem. Dial the # and you were online. SIMPLE AND EASY INTERNET: Routing, networking, Firewalls, VPNs, NAT, etc. Interconnectivity Productivity drives our business (try to do more with less) Almost everything is becoming networked 5

6 6 Remote Secure Connections

7 VPN 3 Key Security Attributes: Authentication: Certificates vs. Pre-Shared Keys Certs are digital passports that prove the identity Certs are digitally signed and unique Certs use X.509 That is a universal PKI standard Free Certificate tool XCA Certs PSK is a password used in both peers PSK is not as secure as certs Less flexible in its use Encryption: The process of encoding the info in such a way that only the person (or computer) with the key can decode it. DES / 3DES AES 128 / AES 192 / AES 256 Hashing: in order to protect data a hash value can be used to uniquely identify secret info, this is done through cryptographic hash functions. MD5 / SHA-1 / SHA-256 / SHA-384 / SHA-512 HASH are not meant for security, but for ensuring that the data has not changed due to accidental corruption 7

8 Remote Secure Connections HQ in Harrisburg Houston 8

9 VPN Requirements (PTP) At end customer side: Ultimate destination must be the Internet via wired connection, wireless broadband, cellular, etc. Can go through the customer s network, wireless access point, have a direct connection, etc. The end device will initiate the VPN (start the conversation) So nothing needs to be opened in-bound, just allow replies back Push button initiation makes this easy By default we use the standard VPN ports (UDP 500/4500). (Usually open outbound) Easy to customize to use another port (e.g. http TCP 80) 9

10 VPN Requirements (PTP) At HUB/Host side: Your side of the tunnel can terminate at a VPN device, or another type of router (e.g. Cisco). You can ask your IT to pass through the VPN traffic to a gateway behind it. Need some coordination from your own IT group Your central VPN gateway can sit on the edge of the network Or behind a firewall IT needs to open firewall to allow VPN traffic through 10

11 VPN Requirements (H&S) Remote Techs: Work from home, hotel and vacations 24/7 support was promised Treat the VPN connection as end customer VPN Compatible SW / HW 11

12 VPN Challenges Looking for the best way to support your machines remotely and securely without travels Don t have the time or knowledge to support a solution on your own Want to avoid to have the talk with all IT departments at end customers There are changes that you need to do in your customers network that you can t control 12

13 Industrial VPN Cloud Services Your tunnels don t need to be PTP Leverage the power of the cloud Maximize flexibility and easily scalable VPN Service Provider becomes your IT department for VPN needs Internal Data Center hosting The configuration for the hardware is provided Setup takes place in a few easy steps online Registration VPN requests for new techs and/or machines More Access to your industrial equipment does not have to be difficult, insecure or expensive OEMs, machine builders and system integrators can give their end customers more secure and reliable support, which frees up time for other projects 13

14 Applications Scenarios OEM s, SI s, Engr. Firms, End users. What do we have in common? No matter the machine, system/process or upgrade you build, sell or use If "long term maintenance", "support agreement", "warranty contract"... In other words if you are committed to support, update and maintain your machine or controller over a period of time 14

15 Conceptual Overview Hub & Spoke Service technician Service VPN: IPsec VPN tunnel between mguard (or certified VPN Client) and Service Gateway Service Gateway mguard Portal App customer Internet Cloud Routing & Management Machine VPN: IPsec VPN tunnel between mguard and Machine Gateway Machine Gateway 15

16 Remote Support through the cloud Sign in us.cloud.mguard.com Select the remote panel you want to support (unlimited machines supported) Click the START button Talk to your panel as if you were locally connected 16

17 PTP vs. Cloud What is right for me? Point to Point: You want to manage the VPN solution IT department is involved & on board with the solution Have the technical knowledge M2M applications (machine to machine communication like a PLC at location X sending information to location Y) VPN connections needs to be always ON 17

18 PTP vs. Cloud What is right for me? Cloud Services: You don't want/care who manages the VPN service IT department has always been a road block for control engineers Don't have a technical engineer who can take care of the solution T2M applications (technician to machine communication like an OEM troubleshooting) VPN connection is used as needed, then disconnected 18

19 Summary VPN Technology Requirements and challenges PTP VPN vs. Cloud VPN Who manages? T2M or M2M? Don t sacrifice security, ease of use or performance mguard Secure Cloud We make it all work for you (just some information needed) Download, or SD card configuration provided Free VPN service, just mguard hardware needed 19

20 Questions? Resources: Brochures available (print or pdf) Technical documentation and articles Online virtual training (Phoenix Contact VTC) Phoenix Contact USA YouTube Channel 20

21 Thanks! Paul A. Mercier