Networks And Security For Data At Rest And Data In Transit - Honeywell GasLab Q2 Manual

2.8.3. Networks and security for data at rest and data in transit

All enCore device data is written and stored on the SD card in the device. This data is also called data
at rest. To prevent unauthorized access, the configuration data is encrypted starting with basic
system version 03-39-A. Write access is only possible after authentication with user name and
password. The security switch (SSW) also prevents manipulation of the device.
Data-in-transit is the data that is transferred between an enCore device and e.g. a control station
in a public or trusted network or between enCore device and enSuite e.g. when transferring data
during parameterization of the device. The communication between the enCore device and enSuite
is carried out via MMS (Manufacturing Messaging Specification), which is encrypted since Basic
System 03-39-A to prevent data from being read by other network users.
The encryption is carried out using the TLS (Transport Layer Security) transmission protocol. The
enCore device uses a self-signed certificate to authenticate itself to enSuite each time an MMS
connection is established. The devices are always delivered without a certificate, which is
automatically created when the enCore device is put into operation and announced to enSuite
during the first MMS connection. This certificate is retained until it is changed / deleted manualy.
To increase security, we recommend changing this certificate on the enCore device or on the remote
operation panel before regular operation and having the device create an up-to-date certificate with
administrator and user passwords set up. The certificate information can also be viewed on the
enCore device or the remote operation panel. Details on the use of certificates will follow later in
this document.
Other protocols that are also used in the enCore devices - e.g. Modbus - transmit data partly in plain
text. If possible, use the secure variant of a protocol.
described in the next section.
options are included in every enCore device.
Communication
Ethernet
Serial communication
(RS232, RS485)
We recommend using a VPN connection whenever you need a secure data connection, but
no secure protocol is supported for data transmission
connexion VPN chaque fois que vous avez besoin d'une connexion de données sécurisée,
mais aucun protocole sécurisé n'est pris en charge pour la transmission des données
Information for general use
Rev. M / 73023639
SAFETY AND WARNING INFORMATION
Supported data protocols are shown in the following table. Not all
Supported data protocols
•
DSfG (class B)
•
HTTP (only up to version 03-38)
•
MMS (secured via TLS)
•
Modbus TCP
•
NTP
•
SMTP (unencrypted, SSL/TLS, STARTTLS)
•
DSfG (class A)
•
Modbus (ASCII, RTU)
•
UNIFORM
38
To increase security, also use a firewall as
.
Nous recommandons d'utiliser une
GasLab Q2