ARCHITECTURE.md

Sanitized Architecture Notes

Logical Data Path

+---------------------------+
| Authorized Modbus Client  |
+-------------+-------------+
              |
              v
+---------------------------+
| Inline OT Security        |
| Appliance                 |
|                           |
| - Layer-2 forwarding      |
| - Modbus inspection       |
| - Policy enforcement      |
| - Security event logging  |
+-------------+-------------+
              |
              v
+---------------------------+
| Industrial Gateway        |
+-------------+-------------+
              |
              v
+---------------------------+
| PLC / Controller          |
+---------------------------+

Design Principles

Inline transparency

The security appliance is placed in the communications path without requiring the industrial endpoints to be redesigned simply to accommodate the control.

Application-protocol awareness

Policy decisions are based on the meaning of Modbus operations rather than only TCP port or address information.

Management separation

Administrative access is separated from the field-facing path to reduce unnecessary management exposure.

Failures must be observable

Qualification uses both functional tests and security-engine telemetry so an apparent application failure can be distinguished from an intentional security block.

Deployment identity is unique

Machine identity, credentials, host keys, and other per-device values are generated or configured per appliance rather than copied from a qualified source system.

Portfolio Boundary

The public architecture intentionally omits:

• real interface names;
• subnets and host addresses;
• customer/site topology;
• exact NAT behavior;
• actual remote-access design;
• rule syntax and identifiers;
• device models tied to the employer's deployment; and
• firmware-specific hardening selections.