Enforcing PLC Network Security via One-Way Cloud Data Push
How unidirectional gateways isolate operational technology from enterprise cloud risks.
A secure one-way cloud data push architecture is a data connectivity method that allows industrial systems to transmit operational data outbound to a cloud-based platform while physically and logically preventing any incoming traffic or command execution. Operational technology (OT) environments, particularly within Good Manufacturing Practice (GMP) regulated sectors, require absolute isolation of primary control loops from external networks. Traditionally, industrial facilities achieved this security through physical air-gapping, which eliminated external cybersecurity risks but prevented companies from acquiring and analysing real-time energy performance data. Modern industrial operations resolve this dilemma by using outbound-only communication pathways that transmit data to cloud analytics platforms without opening inbound ports.
For automation engineers, IT/OT managers, and cybersecurity leads in highly regulated industries like pharmaceuticals and chemicals, verifying the safety of these connections is paramount. Any potential write-back capability poses a severe risk of process tampering, batch corruption, or recipe modification. By enforcing a zero-write architecture, facilities guarantee that the cloud-based analytics engine cannot interfere with physical actuators, valves, or safety PLC logic.
Defining the Secure One-Way Cloud Data Push Architecture
A secure one-way cloud data push architecture establishes a strictly unidirectional flow of data from the secure plant floor up to cloud-hosted analytics databases. To understand this mechanism, engineers must distinguish between physical data diodes and logical unidirectional gateways.
Physical Data Diodes
A physical data diode uses hardware components to restrict signal propagation to a single direction at the physical layer of the network. An optical data diode, for instance, consists of an LED transmitter on the high-security OT side and a phototransistor receiver on the lower-security IT or cloud-connected side. Because there is no physical fibre strand or copper wire running in the opposite direction, photons can only travel outbound. This physical barrier means that TCP/IP handshakes, which inherently require bidirectional communication, cannot complete directly across the diode itself.
Logical Unidirectional Gateways
To maintain compatibility with standard industrial protocols, logical unidirectional gateways deploy specialised protocol proxies on both sides of the physical or logical barrier. The sending-side proxy terminates the local bidirectional TCP connection from the programmable logic controller (PLC) or supervisory control and data acquisition (SCADA) network, extracts the raw data payload, and transfers it across the unidirectional channel. The receiving-side proxy accepts the payload, reconstructs a new TCP session, and forwards the data to the cloud analytics platform. This ensures that the local industrial network never exposes an open listening port to the external world.
The GMP and Quality Compliance Directive
In chemical and pharmaceutical manufacturing, maintaining strict compliance with regulations such as US FDA 21 CFR Part 11 and EU GMP Annex 11 is mandatory. These standards require rigorous control over data integrity and system access. Introducing any external cloud connectivity tool that allows bidirectional data flows risks violating these standards, as an external network vulnerability could lead to unauthorised recipe changes or batch records manipulation. A unidirectional push model completely removes this risk vector, ensuring that plant data is collected continuously for environmental and energy audits without altering the validated state of the manufacturing process.
Omni Vision.
Omni Vision delivers turnkey utility metering, CO2 tracking, and AI-powered production KPI intelligence — giving you real-time dashboards and actionable insights across your entire facility.
Aligning with the Purdue Enterprise Reference Architecture (PERA)
The Purdue Enterprise Reference Architecture (PERA) serves as the primary model for segmenting industrial control systems (ICS) and separating operational technology from information technology. The secure one-way cloud data push architecture maps precisely onto this framework to maintain strict isolation.
The PERA Levels and Their Boundaries
The PERA model segments industrial enterprises into distinct hierarchical levels:
- Level 0: The physical process, containing sensors, actuators, and valves.
- Level 1: Basic control devices, such as PLCs, safety systems, and variable speed drives.
- Level 2: Supervisory control, including human-machine interfaces (HMIs) and SCADA systems.
- Level 3: Site operations management, comprising manufacturing execution systems (MES) and data historians.
- Level 3.5: The Industrial Demilitarised Zone (IDMZ), where security firewalls and proxy servers reside.
- Level 4 & 5: Enterprise business networks, corporate office automation, and cloud-hosted platforms.
Bridging Level 3 and Level 4/5 Safely
Historically, industrial operators deployed bidirectional stateful firewalls at Level 3.5 to filter traffic passing between the operational networks (Levels 1 to 3) and the corporate networks (Levels 4 and 5). However, misconfigured firewall rules or compromised jump servers in the IDMZ represent a major vector for lateral cyber-attacks.
By positioning a unidirectional gateway at Level 3 or within the Level 3.5 IDMZ, engineers establish a hard logical barrier. The gateway pulls read-only telemetry from Level 2/3 and initiates an outbound connection up to Level 4/5. Because this connection is entirely outbound-initiated, no Level 3.5 firewall ports are opened to accept incoming traffic from the internet, preserving the air-gapped protection required for highly validated manufacturing zones.
Compliance with IEC 62443-3-3 Security Standards
The international standard BS EN IEC 62443-3-3:2019 provides a comprehensive framework for establishing system security requirements and security levels (SL) across industrial communication networks. Implementing a secure one-way cloud data push architecture directly supports compliance with this standard.
Zones and Conduits
Under BS EN IEC 62443-3-3:2019, an industrial facility must segment its control systems into logical or physical groupings called "Zones", based on their critical function and security requirements. The communication pathways between these zones are designated as "Conduits".
When connecting a manufacturing plant to a cloud-hosted analytics platform, the local control network represents a high-security zone, while the cloud platform represents a lower-security zone. The unidirectional data push architecture acts as a secure conduit between these zones. By restricting data transmission strictly to the outbound direction, the conduit prevents logical propagation of threats from the lower-security cloud zone back to the high-security control zone.
Mapping to Foundational Requirements (FRs)
Implementing this unidirectional conduit directly addresses several Foundational Requirements outlined in the BS EN IEC 62443-3-3:2019 standard:
- FR 1 – Identification and Authentication Control (IAC): This requirement dictates that systems must prevent unauthorised users and processes from authenticating against critical control assets. By utilising a physical or logical one-way push, there is no ingress path for external users, eliminating the risk of brute-force attacks or credential harvesting against local PLCs.
- FR 5 – Network Integrity (NI): This requirement mandates that communication networks must protect the integrity of transmitted data and prevent unauthorised modification. The unidirectional gateway validates that the transmitted payloads contain only outbound energy and environmental telemetry. It strips away any nested command frames, ensuring that the network integrity of the control zone remains completely uncompromised.
NIST SP 800-82 Rev. 3 and Operational Technology (OT) Integrity
The United States National Institute of Standards and Technology published NIST SP 800-82 Rev. 3 (Guide to Operational Technology Security) in September 2023. This guide emphasises the critical role that unidirectional gateways play in preventing unauthorised remote access and command injection into PLC and SCADA environments.
The Core Vulnerability of Bidirectional VPNs
Many industrial facilities traditionally used Virtual Private Networks (VPNs) to transmit operational data to corporate databases or third-party monitoring platforms. While VPNs encrypt transit data, they still establish a logical, bidirectional IP network tunnel between the two endpoints.
NIST SP 800-82 Rev. 3 notes that if an attacker compromises a corporate endpoint or a cloud server connected via a standard VPN, the attacker can move laterally through the tunnel to access local PLCs. Unidirectional gateways resolve this vulnerability. By eliminating the return communication channel at the protocol level, the gateway blocks any incoming command traffic, rendering remote command injection mathematically and physically impossible.
Enforcing Zero-Write Access
In GMP-regulated environments, the concept of "zero-write access" is a vital safety requirement. If an external entity writes to a PLC registry, they could alter critical process parameters, such as cleanroom humidity, sterilisation temperatures, or chemical mixture ratios. Such changes can ruin entire production batches, resulting in substantial financial loss and regulatory non-compliance.
Enforcing zero-write access prevents external users or cloud-hosted analytics platforms from modifying PLC registers, safety interlocks, or controller logic, preserving the core safety and validated parameters of the manufacturing line.
Omni Vision.
Track energy consumption, emissions, and process parameters with seamless PLC/SCADA integration via Modbus, OPC-UA, and MQTT protocols.
Technical Implementation: Secure Industrial Protocols to Cloud
To implement a secure one-way data push, OT and IT teams must select appropriate communication protocols and configure physical and logical components correctly.
Protocol Conversion and Data Serialisation
Industrial facilities often utilise legacy or local protocols such as Modbus TCP, BACnet, or OPC-UA to collect utility and process metrics from field devices. Unidirectional gateways are configured to pull data from these local sources in a read-only manner.
The gateway serialises this telemetry into structured, modern formats—such as JSON payloads—and packages them for outbound transport. This serialisation process strips away any raw industrial protocol command structures, ensuring that only pure data values leave the secure network boundary.
Encrypted Transport and Outbound Port Configuration
To send the serialised data safely to the cloud, the gateway initiates an outbound connection using secure application-layer protocols, such as HTTPS or MQTTS over TLS 1.3.
Because the gateway acts as the active client starting the TCP handshake, the corporate or industrial firewall only needs to permit outbound traffic on standard ports, such as Port 443 for HTTPS or Port 8883 for MQTTS. There is no requirement to open inbound ports on the industrial perimeter firewall, which prevents external network scanners from identifying open entry points into the OT facility.
| Protocol / Component | Traditional Bidirectional Integration | Secure One-Way Data Push Architecture |
|---|---|---|
| Connection Initiation | Cloud polls local OT network or VPN remains open | Gateway initiates outbound connection to the cloud |
| Firewall Rule Profile | Inbound and outbound ports must be opened | Outbound only; zero inbound ports permitted |
| Protocol Flow | Two-way TCP handshake passes data and commands | One-way push terminates return command channels |
| Write Access | Full read and write enabled by default | Hardcoded zero-write capability |
| Vulnerability to External Attack | High; compromised cloud allows remote PLC control | Extremely low; zero backchannel prevents command injection |
Energy Performance without Process Interference: Omni Vision and EPSA
The Omni Vision Energy Intelligence Platform serves as a turnkey solution designed for comprehensive energy management, monitoring, and reduction. It demonstrates how industrial facilities can combine precision hardware integration with advanced cloud analytics while maintaining maximum OT security.
Comprehensive Utility Stream Metering
To achieve deep energy optimisation, the Omni Vision platform integrates precision instrumentation to perform real-time metering of six core utility streams:
- Electricity: Tracking active power, reactive power, power factor, and peak demand.
- Gas: Monitoring natural gas consumption to optimise boiler operation and combustion efficiency.
- Water: Measuring incoming water volumes and wastewater discharge to identify leaks and process losses.
- Steam: Analysing steam flow and temperature to identify condensate receiver issues and thermal distribution losses.
- Compressed Air: Monitoring flow and pressure to pinpoint leaks, which often account for significant energy waste.
- Oil: Tracking fuel oil usage to calculate accurate boiler efficiencies and thermal inputs.
Cloud Integration via the EPSA AI Engine
The collected utility data is pushed outbound via the secure one-way architecture to EPSA's cloud-based AI analytics engine. This engine performs analytical functions to identify energy-saving opportunities, enabling site operators or building-management systems to execute efficiency adjustments during validated change windows:
- 24/7 Anomaly Detection: Identifying sudden spikes in energy consumption or deviations from established baselines.
- Predictive Forecasting: Projecting future utility demands based on historical production data and external factors such as ambient weather.
- Production-Linked KPI Mapping: Linking energy consumption directly to manufacturing outputs, enabling metrics like energy per batch in pharmaceutical facilities or energy cost per tonne in chemical plants.
Compliance Reporting and Audit-Ready Data
By transmitting accurate, real-time telemetry, the platform provides audit-ready data that simplifies compliance with key national and international standards. This includes supporting automated Scope 1 and 2 carbon emissions reporting, which is essential for frameworks such as ISO 50001, Streamlined Energy and Carbon Reporting (SECR) in the UK, the Energy Savings Opportunity Scheme (ESOS), and the EU Emissions Trading System (EU ETS).
Rapid Turnkey Deployment and Proven Return on Investment
The Omni Vision platform utilises a standardised 8 to 16 week turnkey deployment model, allowing facilities to transition quickly from manual spreadsheet tracking to centralised, automated intelligence. By implementing these precise security and analytics measures, industrial plants consistently achieve 15 to 25 per cent energy cost reductions, yielding a sub-12-month ROI while preserving the validated state, safety protocols, and operational integrity of the underlying manufacturing lines.
Verifying One-Way Integrity: A Checklist for OT Security Leads
Before connecting any energy intelligence hardware to the corporate network or cloud, automation engineers and security leads should verify that the selected architecture meets strict security and validation requirements.
- Confirm Outbound-Only Firewalls: Verify that the plant firewall rules completely block all inbound connection requests from the cloud IP address block.
- Validate Protocol Conversion: Ensure that the local gateway parses incoming PLC registers (such as Modbus or OPC-UA) and serialises them into secure outbound formats (such as JSON) without exposing raw industrial protocols to the external network.
- Confirm Zero-Write Hardware Controls: Ensure that the physical interface or the gateway software has no code paths, drivers, or physical circuits capable of issuing write commands to the PLCs.
- Ensure Cryptographic Protection: Verify that all outbound data pushes use modern encryption standards, such as TLS 1.3, to protect data in transit.
- Review Standard Alignment: Confirm that the network architecture and gateway deployment align with BS EN IEC 62443-3-3:2019 Zone and Conduit requirements, as well as the guidelines defined in NIST SP 800-82 Rev. 3.
This article reflects the independent analysis and editorial opinion of EnerTherm Engineering. Product names, trademarks, and brands mentioned belong to their respective owners. EnerTherm Engineering is not affiliated with, endorsed by, or a licensee of any third-party software or product mentioned unless explicitly stated.
Simulation Engineer — EnerTherm Engineering
Rajesh Sekar is a Simulation Engineer at EnerTherm Engineering, specialising in computational fluid dynamics (CFD), finite element analysis (FEA), and thermal process simulation. He holds a degree from Cranfield University and brings extensive experience in simulation-based product development from the automotive, aerospace, and energy sectors.
