<div data-id="be109c3" data-element_type="widget" data-widget_type="theme-post-content.default" id="isPasted">Written by Laurens SlatsVPNs are, in many ways, adding the &lsquo;S&rsquo; for Security to IoTAs we navigate our way into an increasingly digital realm, the Internet of Things continues to revolutionize how we monitor our environments, control our surroundings and increase efficiency in everyday life. As our reliance on IoT grows, so does our need for secure communication. In this article, we will look into the possible design of a secure IoT application using a Virtual Private Network (VPN).&nbsp;<h3>How is my data being routed?</h3>When designing the security implementations of an IoT application is it essential to know how data is being routed. Understanding the journey of your data helps you craft an IoT security strategy that can effectively safeguard your data.IoT data typically originates from a device, travels to a base station, then onto the core network of a Mobile (Virtual) Network Operator. Finally, data is routed to a server endpoint for storage and processing.<img src="https://images.wevolver.com/eyJidWNrZXQiOiJ3ZXZvbHZlci1wcm9qZWN0LWltYWdlcyIsImtleSI6ImZyb2FsYS8xNjkxMzE2MjI1NjM0LVNFQ1VSSVRZIE9WRVJWSUVXLmpwZWciLCJlZGl0cyI6eyJyZXNpemUiOnsid2lkdGgiOjk1MCwiZml0IjoiY292ZXIifX19" style="width: 582px;" class="fr-fic fr-dib">IoT Device: Communication is often initiated from the end device which spends most of its life in deep-sleep mode to conserve energy. It only wakes up to inform the server about its latest sensor readings or state changes. These devices have a cellular module and a SIM card to authenticate and connect with the cellular network. The device transmits data over the air which is referred to as the radio layer.Base Station: Devices connect to a specific cell tower, also known as a base station. Base stations demodulate the radio signals and send data over the so-called S1 Interface to the core network of the device&rsquo;s mobile operator. Base stations review the device&rsquo;s APN configurations to determine the destination of the data.Core Network: The core network is responsible for handling functions like user authentication, mobility management, and IP (Internet Protocol) address assignment. It also routes data to its intended destination via the public Internet.Server: The ultimate destination: the server. The server could be a cloud-based platform or an on-premises private server, for example, hosted in a trusted AWS or Azure domain. Here, the data is stored, processed, and analyzed.&nbsp;&nbsp;<h2>VPNs in IoT</h2>Let&rsquo;s dive into the role of VPNs in IoT security.Think of an IoT data packet as a postcard traveling through a mail system. Just like a postcard, data sent over the internet is visible to anyone handling the message if not properly secured. A VPN acts like an envelope, providing a secure wrapper around the message to hide the contents, and ensuring that it can&rsquo;t be read while in transit as it uses private mailboxes inaccessible to the public.Although VPN clients can be installed on the end device directly, VPNs are commonly used to secure traffic from the core network, up to a private server. This secure connection between two endpoints is what is called a VPN tunnel.&nbsp;<img src="https://images.wevolver.com/eyJidWNrZXQiOiJ3ZXZvbHZlci1wcm9qZWN0LWltYWdlcyIsImtleSI6ImZyb2FsYS8xNjkxMzE2MjcwNzU4LVNFQ1VSSVRZIE9WRVJWSUVXIFZQTi5qcGVnIiwiZWRpdHMiOnsicmVzaXplIjp7IndpZHRoIjo5NTAsImZpdCI6ImNvdmVyIn19fQ==" style="width: 708px;" class="fr-fic fr-dib">Secure tunnel The VPN tunnel is created to connect two IP endpoints, e.g. the Core Network and a private server running in AWS or Azure. This secure tunnel allows data to be transferred through the public internet, without intermediate parties being able to read what&rsquo;s sent through it. Imagine each data packet being encapsulated in a new message which hides the content of the original message and can only be delivered to one specific postbox. Once delivered at the end of the tunnel (the private server), the data gets decapsulated and the original message is delivered.Hidden IP address The encapsulation of the original message not only hides the content of the message but also masks the IP addresses of the original sender and receiver. If the message would get intercepted, only the IP addresses of the VPN tunnel&rsquo;s endpoints would be shown, not the actual ones.Additional encryption A nice add-on that comes with all VPN services is the additional layer of encryption. VPNs not only create a tunnel between two endpoints, they also encrypt the payload to further protect their content (for example using the IPSec protocol).&nbsp;<h3>What is the required level of security?</h3>Not all data is equal. Some data is highly sensitive, such as personally identifiable information or healthcare data, and requires robust security measures. Other data might be less sensitive but still requires protection to ensure data integrity and authenticity.When designing the architecture of an IoT application, security needs to be designed from the device, up to the server. Depending on the security needs, one or multiple redundant layers of protection can be implemented. This multi-layered approach &ndash; known as defense in depth&nbsp;&ndash; ensures ongoing protection even if one layer is compromisedBy default, cellular communication is secure from the IoT device up to the core network as per <a href="https://www.3gpp.org/" data-wpel-link="external" target="_blank" rel="external noopener noreferrer">3GPP</a> standards. This includes authentication (verifying the device&rsquo;s identity using AKA or EPS-AKA), radio layer encryption (protecting the data sent over radio waves using EEA algorithms), and a trusted S1 Interface (often using a method called IPSec).In addition, to ensure end-to-end security, many IoT applications adopt security protocols like DTLS or TLS which secure data traffic between the IoT device and the server.Now, where do VPNs fit into this IoT architecture? VPNs are often used as an additional security layer, though sometimes VPNs are used instead of DTLS/TLS as data is already secured from the device up to the core network.<img src="https://images.wevolver.com/eyJidWNrZXQiOiJ3ZXZvbHZlci1wcm9qZWN0LWltYWdlcyIsImtleSI6ImZyb2FsYS8xNjkxMzE2MzAzNDE4LVNFQ1VSSVRZIE9WRVJWSUVXIEJSRUFLRE9XTiBBTFQuanBlZyIsImVkaXRzIjp7InJlc2l6ZSI6eyJ3aWR0aCI6OTUwLCJmaXQiOiJjb3ZlciJ9fX0=" style="width: 676px;" class="fr-fic fr-dib">Possible security implementationThe design of your IoT application highly depends on the required level of security. Strategies like defense in depth can significantly enhance the security of IoT applications. However, more complex implementations may demand more resources and add complexity to the IoT solution as a whole.&nbsp;<h2>Monogoto ❤️ ️️VPN</h2>At Monogoto, we are fans of VPNs due to their simplicity and effectiveness in securing data. From the Monogoto Cloud, VPNs can be configured to private servers. The beauty lies in its easy setup &ndash; no device implementation is required which adds complexity and demands additional resources (power, memory, processing, bandwidth). All processes are handled by Monogoto, making the creation of a VPN tunnel a straightforward and happy journey.Instead of taking our word for it, we challenge you to try it out yourself. Gain first-hand experience in establishing a secure VPN connection from the Monogoto Core Network up to a private server. Find the instruction on how to set up VPNs with popular cloud platforms in our&nbsp;<a href="https://docs.monogoto.io/platform-manuals/platform/vpn-setup-examples" data-wpel-link="external" target="_blank" rel="external noopener noreferrer">documentation</a>, or request support directly from our&nbsp;<a href="https://forum.monogoto.io/" data-wpel-link="external" target="_blank" rel="external noopener noreferrer">community portal</a>.&nbsp;<h2>P.S. There&rsquo;re more cloud-configurable security implementations</h2>Next to VPNs, Monogoto provides a set of cloud-configurable implementations to boost the security of your IoT application without adding complexity to your application.<ul><li>IMEI lock Bind your Monogoto SIM to a particular device, identified by its unique IMEI number. If the SIM were to be impersonated, it will never work on a device that doesn&rsquo;t match the locked IMEI. <a href="https://docs.monogoto.io/platform-manuals/platform/how-to-configure-device-limitation-by-imei/how-to-configure-thing-to-work-only-with-one-device-imei" data-wpel-link="external" target="_blank" rel="external noopener noreferrer">Learn more.</a></li><li>IP Security Profile Restrict incoming or outgoing data traffic to specific IP addresses and selected ports. IP Security Profiles create a list of trusted IP addresses and block all unwanted and potentially harmful traffic. <a href="https://docs.monogoto.io/platform-manuals/platform/how-to-configure-security-profiles/ip-security-profile" data-wpel-link="external" target="_blank" rel="external noopener noreferrer">Learn more.</a></li><li>Configure alerts Get notified about unusual activities on your SIM. Alerts can be configured for various scenarios which require attention. For example when a device moves, when the IMEI changes, when data consumption exceeds a predefined threshold, or when a device goes offline.</li></ul></div><div data-id="1fd13d7" data-element_type="widget" data-widget_type="author-box.default"> </div>

As we navigate our way into an increasingly digital realm, the Internet of Things continues to revolutionize how we monitor our environments, control our surroundings and increase efficiency in everyday life. As our reliance on IoT grows, so does our need for secure communication.

VPNs Add the S to IoT

<h2 id="isPasted">What is a PLC? Understanding the Basics</h2>PLC, which stand for Programmable logic controllers are industrial-scale devices with computing capabilities, which are used to control production processes in the context of assembly lines, robotic cells, industrial machinery, and other manufacturing settings [1]. They are used in processes like fault detection, high reliability, and programmable manufacturing control. PLCs operate in real-time as their inputs must be processed in very short timescales. The timeliness of their operation is always critical for successfully fulfilling their control purpose. &nbsp;The primary motivation behind the introduction of PLCs several decades ago was to replace hard-coded relay systems with more flexible programmable controllers. PLCs were first deployed in automotive production lines to provide increased automation and reliability in the control of industrial processes.PLCs do not look like conventional computers, as they have undergone a ruggedizing process in order to be hard-wearing and shock-resistant. &nbsp;There are various types of PLC, which vary in the number and type of their I/Os (Inputs/Outputs), their housing and packaging, as well as their capabilities to interact with other PLCs and <a href="https://www.wevolver.com/article/scada-supervisory-control-and-data-acquisition-systems-the-basics-you-need-to-know" target="_blank">SCADA systems</a>. These properties of PLCs determine their ability to operate in harsh industrial environments in ways that resist high temperatures and vibration while being immune to electric noise. &nbsp;The most common functionality of a PLC controller is similar to that of an electromechanical relay. Specifically, a PLC receives a set of discrete inputs and audits whether the input state is on or off. The operation is based on a “scan cycle”, which reads the PLC inputs, executes the programmable logic, and writes its outputs. In the scope of a PLC’s operation, these three steps are continually repeated as scan cycles are executed repeatedly. &nbsp;PLC programs implement a logical “AND” function over a series of inputs. Current is allowed to pass when all input bits are on. Likewise, they also implement a logical “OR” function over a set of inputs that are provided in parallel. In this case, current is allowed to pass if at least one input is on. In implementing these functions, PLCs apply a certain order in the evaluation of the logic functions. It is a strictly left-to-right and top-to-bottom execution, which is contrary to the less strict operation of legacy relays. There are also PLCs that implement more sophisticated functions (e.g., internal discrete logic functions) towards producing outputs that signal completion or some error.End-users (e.g., automation engineers) interact with PLCs to configure them, but also to receive alarms and notifications. To this end, PLCs provide human-machine interfaces (HMIs), including Graphical User Interfaces (GUIs). Common HMI controls include buttons, lights, textual displays, and touch screens. In the case of sophisticated installations, the PLC can connect to a Personal Computer, which provides more sophisticated and more ergonomic user interfaces.<h2 id="isPasted">Components of PLC&nbsp;</h2>A PLC consists of the following main components:&nbsp;<ul id="isPasted"><li>Power supply: It powers the various components of a PLC with DC voltage. To this end, the power supply converts the user’s line AC voltage (e.g., 120 volts in the US) to a lower DC voltage (e.g., 24 volts).</li><li id="isPasted">Processor: This is a solid-state device that implements industrial control functions in a manufacturing setting (e.g., production line, machine tool, robotics device), as well as other process control functions.</li><li id="isPasted">Input/Output (I/O): A PLC comprises various input and output modules. Input modules detect the state of input signals from various sources like push-buttons, switches, and various sensors. On the other hand, output modules are destined to control devices such as relays and lights.&nbsp;</li><li id="isPasted">Communication Modules and Protocols: A PLC’s communication modules facilitate the transfer of digital data between the PLCs and other devices of the industrial site. To enable this transfer, the communication modules implement one or more protocols, including both wireline and wireless protocols. A non-exhaustive list of industrial protocols used by PLCs includes EtherNet/IP, Profibus, Modbus, Interbus, ProfiNet, and more. PLC communication takes place through built-in ports on the device such as USB (Universal Serial Bus), Ethernet, RS-232, RS-485, and RS-422 ports. Using these ports PLCs communicate with software systems, external devices (e.g., <a href="http://wevolver.com/article/what-is-a-sensor-an-in-depth-exploration-and-comprehensive-guide-to-engineering-principles-and-applications" target="_blank" rel="noopener noreferrer">sensors</a>, <a href="https://www.wevolver.com/article/what-is-an-actuator-principles-classification-and-applications" target="_blank" rel="noopener noreferrer">actuators</a>), as well as other control systems like SCADA.</li><li id="isPasted">Redundancy: Non-trivial industrial grade PLC installations offer some sort of redundancy. Specifically, they comprise a shadow PLC system that is destined to replace a primary system in cases where the primary system goes out of order. To detect cases when the redundant system must be activated, PLCs implement a heartbeats mechanism.</li><li id="isPasted">PLC Programs: A key element of a PLC device is its control logic, which is programmed and reflected in specialized languages for <a href="https://www.wevolver.com/article/understanding-industrial-automation-a-comprehensive-guide" target="_blank" rel="noopener noreferrer">industrial automation</a> and electrical systems like Ladder Diagrams and Function Block Diagrams.</li></ul><h2 id="isPasted">PLC&nbsp;Programming - Ladder Logic and Ladder Diagram</h2>PLCs logic can be programmed in different languages, including high-level visual programming languages. One of the most popular visual programming languages for PLC control logic and configuration is Ladder Logic (LL), which is reflected on the ladder diagram (LD)[2]. Ladder Logic's main benefit is that it offers a visual interface, which significantly reduces the PLC programming learning curve. Furthermore, Ladder Logic and Ladder Diagrams are structured like electrical relay circuits, which makes it very easy for electromechanical engineers and industrial engineers to understand and use them. Likewise, familiarity with bit operators and Boolean logic facilitates understanding and using Ladder Logic.From a programming perspective, Ladder Logic expresses logic operations using symbolic notation. Hence, a Ladder Logic program comprises batches of mathematical logic in a symbolic location i.e., based on bit logic operation, which is structured like a ladder. That’s the reason and rationale behind the name “Ladder Logic”. The exact structure of Ladder Logic is dictated by the <a href="https://plcopen.org/" target="_blank">PLCOpen standard</a>, which makes it a standardized programming language. However, Ladder Logic was not invented for conventional programmers of high-level programming languages. Rather it was primarily designed for technicians, electricians, and electrical engineers that are familiar with electric signals. Therefore, <a href="https://www.wevolver.com/article/ladder-logic-symbols-a-comprehensive-guide" target="_blank" rel="noopener noreferrer">Ladder Logic symbols</a> look like electric signals such as contacts and relays. These symbols map to Boolean and symbolic logic in the context of a Ladder Logic program.&nbsp;Ladder Logic is the most popular PLC programming language, yet it is not the only way to program PLC. Other popular languages include Sequential Function Charts (SFC), Function Block Diagram (FBD), Structured Text (ST), and Instruction List (IL). These languages have conceptual and syntactical similarities to Ladder Logic while having a smooth learning curve for engineers and technicians that are familiar with electric concepts.<div class="fr-img-space-wrap"><img src="https://images.wevolver.com/eyJidWNrZXQiOiJ3ZXZvbHZlci1wcm9qZWN0LWltYWdlcyIsImtleSI6ImZyb2FsYS8xNjMxNTM5NzU1ODEzLVBMQ19MYWRkZXJfRGlhZ3JhbS0yLmpwZyIsImVkaXRzIjp7InJlc2l6ZSI6eyJ3aWR0aCI6OTUwLCJmaXQiOiJjb3ZlciJ9fX0=" style="width: 300px;" class="fr-fic fr-dib" alt="Example of an Ladder Diagram for Ladder Logic Programming of a PLC">Example Ladder Diagram</div> <h2 id="isPasted">PLC Applications: Selecting a PLC for your Industrial Application</h2>Given the variety of available PLCs, industrial engineers have to go through a process of evaluating different devices towards selecting the best one for their tasks. To this end, they must review the requirements of their system and of the application where the PLC will be used. Likewise, information and requirements about the I/O capacity of the PLC must be collected, while the type of targeted outputs must be clarified. For instance, the electrical requirements of I/O modules must be documented, including input device voltage, output device voltage, and current. It is also important to identify whether the PLC should support special operations and advanced functions beyond simple discrete (On/off) logic.Another important aspect for the selection of a PLC relates to the memory and CPU (Central Processing Unit) of the PLC device. To determine CPU requirements, it is important to understand the speed of the industrial process or machine to be controlled. This involves identifying the fastest action needed, as well as the time criticality and the response time of the various operations. It is also necessary to factor in the communication requirements in the PLC selection process. Specifically, data sharing needs must be identified, along with the devices (e.g., computer, touch screen in a workstation) that must communicate with the PLC. In this way, any required communication devices (e.g., modems, cables) can be identified as well.The PLC selection process must also factor in the need for interacting with the operator via some interfaces like push buttons or LED (Light Emitting Diode) numeric displays. Specifically, the selected PLC must provide support for displaying the proper messages to the operator, along with any required alarms and notifications. Likewise, the operator should be provided with the means to input data in line with the needs of the application.The PLC selection process must also consider the physical environment where the automation device will be deployed. This is important for employing devices that have undergone proper ruggedization i.e., devices strong and resistant to shocks as imposed by the target environment at hand.&nbsp;Finally, there are also non-technical criteria that determine the selection decision, including the cost of the device and the quality of complementary services provided like training and post-sales support. The various criteria must be weighed against their relevant importance for the application at hand. This will drive the selection of products with proper modules, value-added programmability features, operator interfaces, and costs.Overall, PLCs are among the most popular devices used in industrial control applications. They are also expected to remain at the heart of industrial control in the era of the fourth industrial revolution (Industry 4.0) [3]. However, the emerging Industry 4.0 applications will provide the means for driving the operation of PLCs in intelligent and data-driven ways. Specifically, PLCs operation in the Industry 4.0 will be driven not only by sensors and Cyber Physical devices but also by data analytics on the cloud. &nbsp;This holds the promise to improve the accuracy and intelligence of next-generation <a href="https://www.wevolver.com/article/understanding-industrial-automation-a-comprehensive-guide" target="_blank" rel="noopener noreferrer">industrial automation systems</a>. In this context, it makes perfect sense for younger engineers to learn more about PLCs and their operations.<hr><h2 id="isPasted">References</h2><ol><li>K. T. Erickson, "Programmable logic controllers," in IEEE Potentials, vol. 15, no. 1, pp. 14-17, Feb. March 1996, doi: 10.1109/45.481370.</li><li>M. C. Zhou and E. Twiss, "Design of industrial automated systems via relay ladder logic programming and Petri nets," in IEEE Transactions on Systems, Man, and Cybernetics, Part C (Applications and Reviews), vol. 28, no. 1, pp. 137-150, Feb. 1998, doi: 10.1109/5326.661096.</li><li>M. Azarmipour, H. Elfaham, C. Gries and U. Epple, "PLC 4.0: A Control System for Industry 4.0," IECON 2019 - 45th Annual Conference of the IEEE Industrial Electronics Society, 2019, pp. 5513-5518, doi: 10.1109/IECON.2019.8927026.</li></ol>

Cellular IoT

Latest Posts

VPNs Add the S to IoT

What is PLC? An Integral Component of Industrial Automation

Profiles