How to adopt the advantages of dial-up modems
Dial-up modems have been used successfully for decades. Many Internet based solution attempts have been made to eliminate the obvious disadvantages, but is has often been at the expense of the advantages of the dial-up modem concept.
The Secomea solution has been designed with the workflow of the dial-up modem solutions in mind. It should just be as easy to comprehend, but much easier to deploy and manage, while also addressing the security aspects.
1. Improve speed
– Obviously a dial-up connection suffers from the speed of traditional analogue lines. New machines require larger PLC/HMI programs, and transmission time becomes critical.
– Using the Internet as the carrier is the obvious choice for any remote management solution.
2. Re-using the existing Internet infrastructure
– Dial-up modem solutions obviously need a phone line for both the service engineer and the factory site. Establishing a new analogue phone line is expensive and typically takes weeks from ordering to installation, if even available. Additionally you will typically be charged dial-up fees and minute rates.
– The Secomea solution can utilizes the existing IT infrastructure for both service engineers and SiteManagers. The SiteManager can connect out through the corporate network firewall, and also create a complete separation between the corporate network and the technical network hosting the industrial equipment. Even LinkManager users that have full access to all equipment in the technical network cannot get access to the corporate network. Optionally the SiteManager can make use of a separate Internet connection in form of a 2G/3G/4G module.
3. Automating the ”phone book”
– Dial-up solutions are conceptionally easy to understand and manage. Each site has a unique public phone number. Dial-up solutions typically make use of an excel sheet with dial-up numbers and passwords that are distributed to the service engineers. Adding a new site, however, require the phone book to be updated. Typically the entire phone book would be distributed to all service engineers, even if the service engineer only required access to a few sites.
– In the Secomea solution the ”phone book” is centrally administered, by associating customer sites and equipment groups to the LinkManager accounts. When the service engineer connects with his LinkManager the user only sees what the administrator wants the user to see. If the administrator associates a new device or customer site to the account, it will be immediately available for the LinkManager user to connect to. Furthermore his two-way authentication (certificate and password) to login with LinkManager will require no further password access to the remote equipment the user has been granted access to centrally.
4. Allowing multiple concurrent connections
– Dial-up modems limit the number of concurrent users. Typically the line will just be busy when a user attempts to connect while another user is online. This may be acceptable if the modem is dedicated to one service on the machine, but not if the modem is supposed to be an entry point for multiple services on the device.
– The SiteManager allow simultaneous access by multiple users to multiple services on the same device (http, remote desktop, plc programming, HMI programming, SCADA systems, telnet, ftp etc.). Also SiteManager supports access to multiple machines at the same site. Additionally the Secomea account management assure that on the same machine one LinkManager user can access only certain services (e.g. http), and another LinkManager user can access other services (e.g. PLC programming ports).
5. Revoking access for former employees
– A known problem of dial-up modems is the security issue when service engineers leave the company, as they will have access to phone numbers and passwords. A disgruntled former employee can make much damage.
– When a user of the Secomea solution leaves the company, the administrator disables the associated account and instantly the user’s certificate will be invalidated. Alternatively the administrator can issue a time limited certificate that expires after e.g. 1 day or one week.