How to connect MQTT through a data diode

No access to YouTube? Click here to view locally

Summary

  1. Download and install Cogent DataHub software on both the data source and data user computers.
  2. On the data user side, configure the DataHub to act as a tunnelling Master.
  3. Switch to the data source side, and connect the MQTT client to the DataHub Smart MQTT Broker.
  4. Configure that DataHub to act as a tunnelling Slave, and connect it through the data diode to the tunnelling Master DataHub on the data user side.
  5. Go back to the DataHub on the data user side and configure it to act as an MQTT broker.
  6. Connect your MQTT client.

For more details and options, see the documentation.

DataHub products used: DataHub Smart MQTT Broker, Tunnel/Mirror,

Transcript

  1. How to connect MQTT through a data diode, using a tunnel to connect the MQTT client at the data source to the MQTT client for the data user. A data diode protects the data source from all incoming data and external attacks.
  2. First download and install Cogent DataHub software on both the data source and data user computers.
  3. We will start with the DataHub instance on the MQTT data user machine by configuring it as a Tunnel Master.
  4. On the data user computer, start the DataHub, and from the Properties window, select the Tunnel/Mirror option. Make sure “Accept plain-text connections” is configured for port 4502. That port must be opened on this computer to make the connection, but no firewall ports need to be open on the data source computer. Click Apply.
  5. In the Properties window select Security and then click the Configure button.
  6. Under Users, click the Add button to add a Built-In User.
  7. Enter a username and password.
  8. Uncheck the “Require TOTP Authentication” box because this is a non-interactive connection. Then click OK.
  9. In the Roles, check the “All Data Full Access” box. Then click OK. The data user side is now configured as the Tunnel Master.
  10. Next we will connect to the MQTT client on the data source computer. Switch to that computer.
  11. On the data source computer, start the DataHub, and from the Properties window, select the MQTT Broker. Ensure the Enable MQTT Broker option is checked, and that “Listen for connections on port 1883” is enabled.
  12. In Message Content, select “Interpret messages as JSON data point values” and the Simple message format. Then click the Edit button.
  13. In the Configure Parser dialog window, delete all values in the Per-Point Format entry field.
  14. Type {value}. This will assign the entire content of each MQTT message to be the value of a DataHub point. See the documentation for other options.
  15. Click OK to close this window.
  16. Back in the main configuration, in Options, make sure “Require authentication” and “Use per-topic permissions” are not selected. This will simplify your security requirements for now. See the documentation for enabling security later on. You can keep “Mark data as Not Connected” selected.
  17. Leave all the other options at the default settings, and click Apply.
  18. Open your MQTT client and connect it to your DataHub MQTT Broker.
  19. Create an MQTT topic name as a two-part string separated by a slash, like Device1/Msg1. The first part of the string is for the DataHub domain and the second part is the point name.
  20. Enter a test message and publish it to the DataHub MQTT Broker.
  21. Back in your DataHub instance, click View Data to see your data in the Data Browser. The MQTT client for the data source is now connected.
  22. Now we will configure the tunnel connection through the data diode.
  23. Still on the data source computer, select the Tunnel/Mirror option. Make sure the “Act as a tunnel/mirror slave” option is checked, because this DataHub instance is the tunnel slave. Then click the Add Master button to add a tunnel master.
  24. Enter the IP address or computer name for the Primary Host, the tunnel Master, which is the data user computer where the other DataHub instance is running. For details about connecting through your data diode, consult your hardware supplier.
  25. Enter the first part of your MQTT topic name for the Local data domain, as well as for the Remote data domain.
  26. Enter the username and password for the networked user that you created on the Master.
  27. For the Data Flow Direction, choose “Write-only” to just send data to the data user.
  28. When the connection is initiated, when it first starts, you want to override the data user values with the data source values. So choose the Override option.
  29. When the connection is lost, you want to mark the data quality for all points over there on the Master as “Not Connected”. So choose that option.
  30. Check the “Run in data diode mode” option to enable data diode support. If you don’t have a hardware data diode, this mode enables software emulation. Click OK and Apply.
  31. Now switch back to the data user computer.
  32. On the data user computer, click View Data to see the data, coming across the tunnel from the data source. The data is now updating here on this DataHub instance.
  33. For the final step, we will connect the MQTT client for the data user.
  34. In the DataHub Properties window on the data user machine, configure the MQTT broker as you did on the data source computer. Ensure the “Enable MQTT Broker” option is checked, and that “Listen for connections on port 1883” is enabled.
  35. In Message Content, select “Interpret messages as JSON data point values” and the “Simple” message format. Then click the Edit button.
  36. In the “Configure Parser” dialog window, delete all values in the “Per-Point Format” entry field and type {value}. Click “OK” to close this window.
  37. Back in the main configuration, in Options, make sure “Require authentication” and “Use per-topic permissions” are not selected, to reduce security requirements for now. See the documentation for enabling security later on. You can keep “Mark data as Not Connected” selected.
  38. Leave all the other options at the default settings, and click Apply.
  39. In an MQTT client on the data user side, connect to the DataHub MQTT Broker and subscribe to the topic. You should be able to access the MQTT message.
  40. Now you are connected. MQTT source data from behind the data diode is being sent to the MQTT client on the data user side. No data of any kind gets sent back, protecting the OT network from external attacks.

Background

An MQTT client cannot connect through a data diode because MQTT  requires two-way data flow just to send data. Before MQTT data can traverse a data diode, it must be received by a broker and converted to a unidirectional protocol. Outside the diode, the data then gets converted back to MQTT and sent by a second broker to subscribing clients.

The MQTT data source connects to a DataHub Smart MQTT Broker, which uses the Tunnel/Mirror  feature to pass the data through the diode.  A second DataHub Smart MQTT Broker outside the data diode receives the data and makes it available for the MQTT client.

Skkynet provides Cogent DataHub secure-by-design software and services to let you acquire, aggregate, monitor, control visualize, and network live process data in-plant or over insecure external networks, making it ideal for OT to IT and cloud connections.  You can isolate control networks from cyber attacks and integrate industrial data under a unified namespace, all without compromising the plant.

Cogent DataHub products wheel diagram