4-Port Ethernet Line Breaker with relay controlled Ethernet ports and integrated I/O module
ipELB is a cybersecurity system for industrial networks that can physically disconnect Ethernet connections. It features relay-controlled 10 Gigabit Ethernet ports, each of which can be turned on and off via a toggle switch on the device as well as remotely. Remote control is based on standardized communication protocols.
To enable/disable the Ethernet ports, bistable relays that maintain their state even during power outages are used. Existing connections will not be affected accordingly.
The applied SEC3ER hardware platform features a digital I/O module to control and capture digital states, and to physically disconnect up to four Ethernet port pairs. For this purpose, eight digital inputs and outputs are available, in addition to a variety of fieldbus protocols, telecontrol protocols, and established IT/cloud protocols, to monitor and control the connections of the 4-Port Ethernet Line Breaker.
The integrated web interface provides numerous configuration settings to automate the separable Ethernet connections. It includes powerful functions for data processing and provides a digital I/O interface that can be used to create complex switching scenarios.
Support for 10M / 100M / 1G and 10G Ethernet
Transparent data transmission
Controlled bidirectional data exchange between systems
Connection to the corporate IT via the REST interface
Clustering multiple SEC3ER to implement complex architectures
The following use cases illustrate potential applications of ipELB.
Redundant ISP Integration
For seamless switching between redundant Internet providers (ISP), the product ipELB is ideally suited. SEC3ER, which serves as a hardware platform, can physically disconnect up to 4 Ethernet ports.
The diagram shows the schematic structure of a corporate network. System operators can control and automate which ISP is set active by using industrial protocols. The corporate IT can also decide which connection is to be used by using the mechanical 3-way switches. Automated connections are overridden by manual switching.
Redundancy Coupling for Standalone Systems
To ensure operation and reliability of critical systems, companies deploy redundant systems. Yet many devices do not meet this requirement. With ipELB even such devices can be used for redundant operation.
This is achieved by connecting two identically configured devices (e.g. by assigning identical IP addresses) on two Ethernet ports of the 4-Port Ethernet Line Breaker SEC3ER. The passive component remains physically separated from the network. If the active component fails, its connection is cut while the connection of the passive device is set active. An automatic redundancy control of this kind can be implemented, for example, using the digital I/O interface.
If the physical connection status of specific network segments needs to be monitored and remotely controlled, we recommend the use of ipELB.
In case of security incidents within the corporate network, affected segments can be isolated selectively by physically separating corresponding connections. Communication on all other lines remains unaffected.
One option for controlling (and automating) the connections is the integration of intrusion detection systems (IDS). These detect anomalies in communication and can reliably disconnect affected connections using ipELB.
Secure Remote Maintenance
With the increasing degree of networking between machines and industrial facilities, the need for remote maintenance access to optimize costs is likewise growing. At the same time, this raises the risk of cyber attacks, especially if systems with insufficient security mechanisms or legacy systems are deployed.
With ipELB, network connectivity can be provided and monitored for secure remote maintenance. If momentarily not required, the maintenance connection can be physically disconnected. Thus potential attackers have no opportunity to exploit the idle port to infiltrate malicious code.
System configuration is completely performed in a web browser. No other special configuration tools are required. A conventional notebook with a
network interface and web browser are all that is necessary.
ipConv in its current version 4 enables encrypted communication between web server and browser via the HTTPS protocol.
The main menu provides access to all relevant functions of ipConv, showing the overall system status at a glance.
The following functions are available:
Switch between operating mode OPERATIONAL (unattended station) or MAINTENANCE
(allows full access to all ipConv functions)
Backup and restore the complete configuration
License management (ADMIN)
Installation of (DEMO-) licenses, limited or unrestricted licenses
Creation of custom logbooks Changes of normalized information are selectively documented in configurable logbooks for tracing or logging reasons over a period of time.
Access current logfiles
Excel Import The Excel file can be imported directly (Supportet formats: .xlsx, .xlsm, .csv)
The following example shows the overview of an information object taken from the node configuration (in this case for the digital I/O output DO1).
The category "Status", assigned to the information object, is used to display the object's value in the diagnostics area (see Diagnostics).
ipConv enables fast and efficient processing of great volumes of data points by allowing data import from tables. These tables are based on templates and may be processed with various spreadsheet programs, such as Microsoft Excel. The extended use of formulae minimizes the amount of data that needs to be configured manually, substantially reducing the number of errors.
ipELB allows to determine the communication status on all interfaces at a glance at any time. If there is no personnel familiar with the system present on site, it is a major advantage that a non-specialist is capable of doing so as well.
A unique feature of ipELB is the supplied diagnostics template for visualizing and controlling the different states of the 4-Port Ethernet Line Breaker. As the following figure demonstrates, the state of each Ethernet relay can be monitored and controlled remotely through the web interface. Even without telecontrol protocols, the Ethernet connections can be set active or interrupted remotely.
With this template, digital output states can be set as well. This is particularly useful to test certain functions with remote stations. Digital input signals are visualized in this context.
The configuration determines, which information is shown with which text or color.
Apart from indications or measured values, command controls can also be displayed as a button, e.g. to initiate a general interrogation.
Should further diagnostic functions be required, these can be added and customized in the configuration.
Available Protocol Stacks
DNP V3.00, Master
DNP V3.00, Slave
Simatic Fetch/Write, Master
IEC 60870-5-101, Master
IEC 60870-5-101, Slave
IEC 60870-5-103, Master
IEC 60870-5-103, Slave
IEC 60870-5-104, Master
IEC 60870-5-104, Slave
IEC 61850, Client
IEC 61850, Server
Modbus TCP/IP, Master
Modbus TCP/IP, Slave
OPC DAXML 1.01, Server
OPC UA 1.02, Client
OPC UA 1.02, Server
S7 Protocol, Client
Relay-controlled 4-Port Ethernet Line Breaker with integrated I/O module