Practical Industrial Internet of Things Security
上QQ阅读APP看书,第一时间看更新

Pattern 2 – Layered databus architecture

A databus is a logical abstraction of connectivity that implements a common set of schemas and a common data model. In a layered databus model, each endpoint in a given layer communicates using that common set of schemas.

The layered databus architecture provides low-latency (real-time), secure, peer-to-peer data communications both within and across the logical layers of an IIoT deployment. This pattern is useful in industrial use cases where control and monitoring are distributed at various operational layers. For example, in a SCADA system in an oil rig, smart machines and controllers deployed in the remote field locations need to directly communicate control and monitoring data, which can also enable faster local analytics.

Supervisory controls, monitoring, and analytics are contained in the supervisory layer.

A separate databus can connect a series of systems for coordinated control, monitoring, and analysis at the next higher level.

In a layered architecture, the databus at various layers may have a different set of schemas or data model. To allow communication across different layers using different data models, a lower-level databus exports only a controlled set of internal data.

To match data models across different layers, databus gateways or adapters may also be used. The adapters may also separate and bridge security domains, or act as interface points for integrating legacy systems or different protocols (IIC-IISF).

The transitions between the layers may filter and reduce data. Since the scope of control and analysis increases at every layer from the bottom up, it is important to reduce the amount of data transmitted across layers to match the increase in scope, latencies, and also level of abstraction.

The data-centric publish-subscribe communication model is very common to data buses, where applications in a given layer simply "subscribe" to data they need as inputs and "publish" information they produce. This publish-subscribe communication model is effective for quickly distributing large quantities of time-critical information, especially when the delivery mechanisms are not very reliable.

Object Management Group's (OMG) data distribution service (DDS) standard utilizes this layered databus model. Message Queuing Telemetry Transport (MQTT) uses a broker-based publish-subscribe model. DDS and MQTT, and their security capabilities, are discussed in Chapter 5, Securing Connectivity and Communications.

In Figure 2.10, a representation of large SCADA systems used for oil monitoring and operation control is shown as an example implementation of the layered databus architecture:

Figure 2.10: Example of layered databus architecture pattern; Source: IIC-IIRA