OT AND MANUFACTURING
Out of the plant network, without a USB stick
Operator stations, engineering workstations and historian clients are kept off the corporate network for good reasons. Their logs, batch reports, alarm exports and recipes still have to leave — and in many plants they leave on a USB stick, the route most security programmes are trying to close.
Written by Taha Bayar, who builds Kionel. Kionel is one of the options below; the comparison is meant to be usable even if you choose another.
What Kionel does on the plant floor
- No media, no network, no agent. The station shows the file as a stream of codes in a browser; a phone or tablet films it. Nothing is plugged in and nothing is installed on the station.
- Integrity you can show. The file is encrypted to the receiving device, its SHA-256 is signed by the sending station together with the work order or change ticket, and the receiver signs that it arrived intact.
- A record per transfer. Dispatch and delivery records, a printable report, and a local hash-chained log make each movement auditable.
- Proof without the file. Where the data must not leave at all, the station can seal a file — hash, size, time, ticket — and only the small signed seal goes out.
Direction matters — read this first
| Direction | Fit | Why |
|---|---|---|
| Out of the plant (logs, reports, recipes, alarm exports) | Good | The station only needs a screen; the phone outside does the reading. |
| Into the plant (patches, firmware, new recipes) | Only with a camera on the target | The receiving machine must see the sending screen. Most HMIs and many workstations have no camera, and adding one may break your baseline. |
| Large files (historian archives, full backups, images) | Wrong tool | Optical transfer carries tens of kilobytes per second. Use a data diode or a controlled network conduit. |
Compared with the usual routes
| Controlled USB + kiosk | Data diode | Kionel | |
|---|---|---|---|
| Physical media in the zone | Yes | No | No |
| Installation | Kiosk, procedure | Hardware, network change | A browser |
| Signed record per file | Depends on logs | Depends on software around it | Built in |
| Throughput | High | High | Small files |
| Typical cost | Kiosk in the tens of thousands of dollars | Similar, plus installation | Annual licence per site |
Kionel has not had an independent security audit yet; its protocols are modelled and machine-checked, with results on the security page. It does not inspect file content for malware.
Try it on one station
The free personal edition moves your own files up to 5 MB so you can see it work on a real station before anyone buys anything. The signed records come with a business licence.