%20Solution%20Deployment%20Examples%20in%20OT.jpg)
Solution Deployment Examples in OT
Explore how swIDch's adaptable Endpoint OTAC solution
seamlessly integrates into diverse OT environments,
offering flexible deployment options tailored to your unique operational needs.
Standalone
In standalone mode, Endpoint OTAC is deployed directly onto a PLC. This offers the most robust solution as everything is running on the PLC and does not require any network connection. Since the OTAC auth MFA is running locally on the PLC, all authentication requests are handled locally.
Server
In server mode, the solution is deployed centrally on an OT network server. This is ideal for protecting multiple OT endpoint devices and systems simultaneously, with each device forwarding authentication requests to the central server for verification.
Hybrid
Hybrid deployment combines standalone and server modes. Each OT endpoint device can authenticate locally if the server or network fails, while normal operations still leverage centralised management for large-scale deployments.
Software Components
Endpoint OTAC can be installed as a complete software with an Admin Portal for user management and onboarding as well as the accompanying mobile app (where OTAC is generated) available on Android and iOS.
SDK
For customers who like more flexibility and integration, the Endpoint OTAC also provides SDK.
One of the top-tier PLC manufacturers made a strategic decision to safeguard their PLCs using OTAC authentication with MFA. Now, every newly manufactured PLC comes equipped with OTAC auth MFA right out of the box—a smart move to enhance security for their customers. To seamlessly blend with their existing services, they opted for the Standalone deployment approach, integrating OTAC auth MFA as an embedded SDK.
Understanding Customer A’s Deployment and Installation Model:
1. User Interaction:
● When a user needs to log in to the engineering application, they are prompted for an entry code—the OTAC
2. OTAC Generation:
● Within their mobile app, we’ve embedded our mobile SDK.
● The user generates an OTAC using our mobile SDK. This OTAC serves as a secure token.
3. Connecting to the Engineering Application:
● Armed with the OTAC, the user then provides it to the engineering application.
● The engineering application establishes a connection via Modbus—a communication protocol—directly to the Security Service residing inside the PLC.
4. Security Service Handling:
● Inside the PLC, the Security Service extracts the OTAC.
● To ensure the user’s authenticity, the Security Service employs our Application SDK.
5. Validation and Authentication:
● Finally, the Application SDK validates and authenticates the user, granting access to the engineering application.
Customer B wanted to fortify the security of existing PLCs for their valued customers. They opted for OTAC auth MFA in server deployment mode. Here’s the breakdown:
- Centralized Management: Customer B appreciated the centralized approach of OTAC auth MFA. It’s like having a vigilant guardian overseeing multiple PLCs simultaneously.
- Deployment Strategy: For this setup, they chose the server deployment route and to complete the picture, they went all-in with a full Software install.
Customer B’s PLCs come with their very own Web Management Portal (WMP)—a web portal to control and oversee the PLC. Here’s how it all unfolds:
1. User Interaction: When a user wants to access the WMP they are prompted for an entry code—the OTAC.
2. OTAC Generation: Our trusty standard mobile app (available on both Android and iOS) generates the OTAC.
3. Forwarding the Request: The user hands over the OTAC to the WMP. The WMP forwards the request to the Verification API running on the central server via a secure HTTPS channel.
4. The Verification: Once the OTAC has been verified it returns the result back to the PLC and to the WMP.
Customer C, another leading PLC manufacturer, wanted to give their customers flexibility and a choice on whether to have OTAC auth MFA deployed in standalone mode running on each individual PLC or on a central server.
- Standalone Mode:
○ For customers with a small number of PLCs, they offered standalone mode.
○ Everything—OTAC auth MFA and all—runs directly on each individual PLC.
- Server Deployment:
○ Customers with larger deployments could choose server deployment.
○ In this setup, everything runs on a central server, and each PLC forwards authentication requests there.
Why swIDch
that provides all of the following features, tested and substantiated
by the University of Surrey technical report
sufficient to IDENTIFY user
and AUTHENTICATION
off-the-network environment
Single-step identification and authentication with the code alone. Include our biometric option and get single-step MFA. Vastly improved UX by removing steps.
OTAC is a dynamic code, which means the code is constantly changing. Eliminates all use of static information. Forget usernames and passwords forever. Vastly reduced workload for IT helpdesks.
No network connection required for generating OTAC, enabling uninterrupted use no matter where you are. No more waiting for additional tokens/OTPs and no need for heavy public key infrastructure (PKI).
Highly configurable code parameters and lightweight SDK/applet means wide range of deployment options on many devices across multiple sectors.