siemens.com/sinema-remote-connectRestricted © Siemens 2020
Secure remote Connectivity
Unrestricted © Siemens 2019
Unrestricted © Siemens 2020
Presenter Profile
Siemens Australia
Organisation
Job Function
Product manager – Industrial Communication
Christoffer Karlsson
Unrestricted © Siemens 2019
Page 3
Support capabilities:
▪ Network & Security Audits
▪ Trainings
▪ Design and Commisioning
services
▪ Tender support
▪ Technical clarifications
▪ Pre- sales support
▪ Proof of concepts
▪ Seminars
▪ Workshops
Introducing Siemens Industrial Communications Team....
Professional Services Team
Ken Yip,
BDM Ruggedcom
Serge Maillet
Portfolio Sales Team Lead
Christoffer Karlsson
Product Manager
Varoon Ashok
FAC
Pawel
Krzysztofik
Bradley
Wilson
Paul
Zhang
Gabriella
Swaby
Peter
Jerusalem
Dylan
Read
Unrestricted © Siemens 2019
Driving the digital transformation of discrete and
process industries with Siemens Digital Industries
Digitalization
Automation
Electrification
V1.6
Digital Enterprise
Design Planning ServicesEngineering Production
Digital twin of the real world across the entire value chain
Process industries Discrete industries
Industrial communication
Industrial security
Industrial services
Automation and industrial
software for the process
industries
Automation and industrial
software for the discrete
industries
Unrestricted © Siemens 2019
Digitalization
changes
everything
And the right communication networks enable you to be ready for it!
V1.6
Unrestricted © Siemens 2019
Digitalization will change the way you work…
Yesterday
Non-digital industry
Central alarm reporting
Mobile applications
Full automation
Tomorrow
Digitalized manufacturing
Secured remote access
Interoperability of processes
Manual processes
Separated islands of automation
No central alarms
Legacy systems
Intransparent processes
Industrial security
Full process transparency
Vertical integration
V1.6
Unrestricted © Siemens 2019
Digitalization results in enterprise and production layer
to get closer connected
Future: Defined interface to
handle complexity
Enterprise
Network
Production
Backbone
Production
Cell
Two dedicated networks with
defined managed interface
Today: Arising challenges through
increasing interoperability
Enterprise
Field
Control
Enterprise
Management
Production
Operator
Challenge to handle complexity of
increasing communication
Interoperability
V1.6
Yesterday:
Limited interoperability
Limited communication between
enterprise and production layer
Enterprise
Production
Unrestricted © Siemens 2019
Remote Networks
Remote communication via private and public heterogeneous networks
• Establish connection on demand
• Medium bandwidth requirement
• Permanent point-to-point
connection
• Low bandwidth requirement
Our product range for remote access solutions covers all
areas of application
• Permanent/on demand connection
• High bandwidth requirement
Industrial Remote Communication
Integration into the industrial security concept
04.2019
DI PA S&V CI PSD
Page 8
Permanent connectivity
Spontanious connectivity
Other applications (Smart grid
applications, video monitoring, …)
Unrestricted © Siemens 2019
Investment protection
• Compatibility with previous and
future system solutions
• Migration concepts
Integrated RTU concept
• SIMATIC based modular RTUs and
compact battery operated RTU‘s
• Various protocols
• Convenient engineering
Security and availability
• Redundancy
• Security integrated: firewall & VPN
Solutions for remote access
Cost reduction
• SCADA solutions, teleservice
systems and network components
from a single source
Fast integration
• Network management
• Standard interfaces
• Software tools
• Integration in TIA Portal V16
Simple operation
• Control systems for process control
• Remote programming
and diagnostics
+
+
+
+
+
+
04.2019
DI PA S&V CI PSD
Page 9
Secure remote access
Management platform
SINEMA RC
Unrestricted © Siemens 2019
Industrial Remote Communication portfolio:
Use in a wide variety of industrial environments
Remote access to machinery and plants
• Secured teleservice access using VPN and firewall
• Simple access to serial machines via the SINEMA Remote Connect
management platform
Complete SCADA solutions for water and energy
• Wide-ranging RTU portfolio based on SIMATIC S7
• Simple and redundant communications via heterogeneous networks
• Intelligent control systems based on PCS 7, WinCC and WinCC OA
The right transmission for any communication
• A complete range of products for wireless connections and landlines
• High security standards
• Flexible modular system for networks
04.2019
DI PA S&V CI PSD
Page 10
Unrestricted © Siemens 2019
Industrial Security concept Siemens
Defense in depth according to IEC 62443
Network security
• Cell protection and perimeter network
• Firewalls and VPN
System integrity
• System hardening
• Authentication and user management
• Patch management
• Detection of attacks
Plant security
• Physical access protection
• Processes and guidelines
• Comprehensive security monitoring
Page 11
Further information: www.siemens.com/industrialsecurity
Unrestricted © Siemens 2019
SCALANCE –
Industrial Communication portfolio
• High availability
based on industrial features and industrial design
• Fast & easy integration
for new and existing networks based on TIA design
• Easy to use
with configuration via Web Based Management or
TIA Portal
• Easy device replacement
with C-PLUG, also by untrained staff
• For all Ethernet networks
local, wireless and remote
Our Portfolio
Remote / SCALANCE M
Wired
Wireless
Security / SCALANCE S
Software
• Industrial features
• Industrial design
• Fast & easy integration
• Indoor and outdoor applications
• Several country approvals
• Real-time capability
• Different medias (DSL, UMTS, LTE)
• Transparent connectivity
• Easy enrollment with SINEMA RC
• Transparency for the industrial network
• Integration into HMI / SCADA systems
• Firewall & VPN
• Remote access
• Fits to industrial security concepts
SCALANCE: Industrial Communication
proved to enable communication in
production
V1.6
Unrestricted © Siemens 2019
Page 13
SINEMA Remote Connect
Remote maintenance and remote control with ease….
SINEMA
Remote Connect
Client
Company
network
SINEMA
Remote Connect
Server
Mobile network
SCALANCE
S615
e.g. CP1243-1
SCALANCE
M804PB
e.g. SCALANCE
M876-4
SINEMA RC
Client
SCADA
LAN router
A
B
SINEMA RC
Client
VPN Connection
A
A
A A
B
A A A B
B
B
Remote pumping station
WAN
Unrestricted © Siemens 2019
SINEMA Remote Connect
Step-by-step implementation
Remote access from TIA portal with SINEMA RC/ works as independent software side by side
Page 14
3. Software
2. Accessories
4. Software location
1. Select hardware for remote location
Virtualization or Cloud
Server and client software
Server and client software
Modems, SIMATIC S7 systems or firewalls
Unrestricted © Siemens 2019
Management of devices and users:
• User management with the configuration of rights
• Device and user management with group management
Connection management:
• Establishment of encrypted connections with OpenVPN and IPsec
• Establishment of permanent or event-based connections (establishment
by wake-up SMS or digital input (DI))
SINEMA Remote Connect Server
Functions
Page 15
Unrestricted © Siemens 2019
SINEMA RC Client
Functions
Establishment of a remote connection:
• Direct connection to SINEMA RC server and the remote location
• By issuing a wake-up SMS (in connection with mobile routers
SCALANCE M874/876)
Security mechanisms
• Tunnel encryption with OpenVPN
PKI smart card login (optional):
• With two-factor authentication by smart card and key
Usability:
• Flexible display of information and saving of user-specific view. IP
addresses that cannot be reached are grayed out.
Page 16
Unrestricted © Siemens 2019
Konfigurationsbeispiel SINEMA Remote Connect:
Gesicherte Anbindungmittels Security-Mechanismen(VPN)
Configuration example SINEMA Remote Connect:
Secured connection by means of security mechanisms (VPN)
Task
• Remote maintenance of machines and larger plants
• Accesses to the machines/plants/system are protected by security
mechanisms (OpenVPN, IPsec)
Solution
• Easy creation of devices with routing/ NAT information in SINEMA Remote
Connect
• Simple selection of a device from the list of devices in SINEMA RC Client
by mouse click
• Industry routers and service technicians can separately set up a secured
connection to the SINEMA Remote Connect server
• SCALANCE M and S devices support firewall and VPN
Benefits
• Time and money saved
• Can be used without specialized IT knowledge
• Flexibility through easy expandability
• Transparent IP communication
• Prevention of manipulation and unauthorized access by means of secured
data transmission and authentication
SINEMA Remote Connect use case
Secured connection by means of security mechanisms (VPN)
Page 17
Unrestricted © Siemens 2019
Konfigurationsbeispiel SINEMA Remote Connect:
Gesicherter Zugriff von TelecontrolLeitstelle zu Fernwirkstationen
Configuration example SINEMA Remote Connect: Secured
access from telecontrol center to remote terminal units
Task
• Telecontrol plant with encrypted connections to the remote
terminal units
Solution
• Telecontrol server and SINEMA Remote Connect server are
available in the telecontrol center
• All secured VPN connections managed by means of
SINEMA Remote Connect
• Local connection of the telecontrol center to SINEMA RC
• Telecontrol accesses to remote terminal units via SINEMA RC
Benefits
• Use of standardized encryption protocols
• Direct connection of the control center to SINEMA Remote
Connect without additional security components (in the control
center)
• Simpler administration because SINEMA Remote Connect
server and telecontrol server are at a single location
SINEMA Remote Connect use case
Secured access to Siemens RTU’s with DNP3
Page 18
1)
Unrestricted © Siemens 2019
Page 19
SINEMA Remote Connect together with TIA Cloud Connector
– solution with SCALANCE M804PB (TIA Cloud Connector integrated)
SINEMA Remote Connect use case
Remote service with SCALANCE M804PB and Step 7
Task
• Remote service with remote access for PROFIBUS via MPI: A service
technician is to access a PROFIBUS plant from outside the company
network
Solution
• Connection of PROFIBUS/MPI plants over SCALANCE M804PB that is
connected to the production cell over MPI
• Easy configuration and management of the VPN tunnels with the SINEMA
Remote Connect management platform enables secure remote access to
the plant
Benefits
• Remote Acess on machines and plants with PROFIBUS/MPI reduces time
and costs for on-site operation
• Easy connection of consiting plants
•
Prevention of manipulation and unauthorized access thanks to secure data
transmission and authentication
Unrestricted © Siemens 2019
Page 20
SINEMA Remote Connect
Getting started….
https://support.industry.siemens.com/cs/gb/en/view/109479599
Promotional package
Unrestricted © Siemens 2019
SINEMA Remote Connect
Page 21
Summary of advantages
• High security with maximum flexibility
• Full end- to- end encryption
• Unlimited number of connections / devices, infinitely scalable
• Controlled enabling / locking of the maintenance object
• Advanced security functionality and process maturity
• Connection to central user management
(UMC server, optionally supplied by MS Active Directory)
• Two-factor authentication through PKI smart card and key
• Secure development process to IEC 62443-4-1)
• Direct support and very high functionality
• Consultation and support during system setup
• Support of common / established VPN standards
• Integrated Siemens network
• Reliable and rugged hardware
• Complete solution from one source for guaranteed compatibility
Unrestricted © Siemens 2019
Seite 22
Features / Functions Benefits
High data rate (100 Mbps download, 50
Mbps upload) and antenna diversity
Transmission of high data rates over
robust wireless connection
Extended temperature range
(-20°C to +60°C)
Use in environments with increased
climatic fluctuations
Supported security mechanisms:
IPsec, OpenVPN, firewall
Increased network security through the
use of common standards
Integrated managed 4-port switch
Up to 4 IP addresses for various subnets
can be configured
Redundant power supply
Reliable operation, even if one power
supply should fail
Support of country-specific standards
UMTS / LTE (incl. US)
Widespread global use
Supported in SINEMA Remote Connect
Convenient and secured maintenance of
widely distributed machines and
installations via remote access
Secure Remote Connectivity with SCALANCE M
Unrestricted © Siemens 2019
Secure Remote Connectivity with SCALANCE S
Page 23
SC632-2C SC636-2C S615 SC642-2C SC646-2C
Industrial security appliance SCALANCE S
Unrestricted © Siemens 2019
SCALANCE S - Industrial security appliances
“End-to-end engineering” in TIA- Portal
Page 24
Task
The security components employed in the network are to
be configurable via standard engineering methods as well
as from a central location.
Solution
The industrial security appliance SCALANCE S supports
common standard methods such as WBM and SNMP, and
can also be centrally engineered via the TIA Portal
1)
.
Benefit
•
Standard methods such as WBM, SNMP, MIB are
supported
•
End-to-end engineering with the TIA Portal
1)
•
Integration into network management systems such as
SINEMA Server and SINEC NMS
2)
1)
TIA Portal V15 or higher
2)
Planned start of delivery in 9/2018
Network
view
Setting of
firewall rules
Creation of VPN
connections
1
2
3
Unrestricted © Siemens 2019
Secure Remote Connectivity – RTU’s based on SIMATIC S7 with DNP3
For small and medium-sized
applications with flexible
configuration..
For large applications with high
demands on the performance..
For medium-sized applications with
flexible configuration..
For small applications with
autonomous power supply.
Modular RTU based on
SIMATIC S7-400
Modular RTU based on
SIMATIC S7-300 / S7-1500
Modular RTU based on
SIMATIC S7-1200
Modular RTU based on Distributed
Controller SIMATIC ET 200SP
Performance of modular RTUs
Unrestricted © Siemens 2019
Page 26
Secure Remote Connectivity Battery powered compact RTU (RTU3000C)
Localization und time
synchronization via GPS
(only with RTU3031C)
Web Server for
configuration and diagnostics
Remote reading and setting
of I/Os
Security mechanisms
• OpenVPN tunnel
• Encrypted e-mail
connection
Data logging on memory
card
Wake-up through SMS or
phone call
High degree of protection
with IP68 external enclosure
Remote communication
• via cellular radio 2G/3G)
• Through external routers (only
RTU3010C)
Time Synchronization via
• NTP
• Telecontrol protocol
• Cellular network
Communication
• SMS or e-mail
• Event- or time-controlled
• Telecontrol protocols:
TeleControl Basic, DNP3,
IEC 60870-5-104,SINAUT ST7
• FTP-Client
• MODBUS RTU/TCP
• HART
Expanded temperature range
-40 to +70 ºC (conformal coating)
Unrestricted © Siemens 2019
Secure connections to the control center
Easy VPN configuration with SINEMA Remote Connect
Secure Remote Monitoring / Control via DNP3
Easy VPN Configuration via SINEMA Remote Connect
Task
All remote stations of a telecontrol system are to be connected to
the control center via public networks using encrypted connections.
All VPN connections should be configured from a central location.
Solution
SINEMA Remote Connect makes secure connections to remote
stations (RTUs) particularly easy.
The CP 1542SP-1 IRC supports SIMEMA Remote Connect with
autoconfiguration, enabling encrypted connections to be
established directly to the RTU.
Benefit
The SINEMA Remote Connect Server is installed on a PC at the
control center. This is where the devices and users, as well as the
encrypted tunnel connections (VPN) are managed.
Unrestricted © Siemens 2019
Thank you for your attention!
Christoffer Karlsson
Product manager
Industrial Communication
885 Mountain Highway
3153, VIC Bayswater
Australia
Christoffer.karlsson@siemens.com
+61437584211
siemens.com/scalance
Page 28
The information provided in this brochure contains merely general descriptions or characteristics of performance which in case of actual use do not
always apply as described or which may change as a result of further development of the products. An obligation to provide the respective
characteristics shall only exist if expressly agreed in the terms of contract. Availability and technical specifications are subject to change without notice.
All product designations may be trademarks or product names of Siemens AG or supplier companies whose use by third parties for their own
purposes could violate the rights of the owners.
Loading...