DCS OT Gateway

The gateway that migrates a plant.

The DCS OT Gateway sits at the edge of an industrial cell. It reads Modbus without touching the controller, has the R-Series engine mint a receipt for what crosses it, and carries the cell's traffic over a hybrid post-quantum uplink. There is no cryptography in the gateway's own code.

Custody rootTPM 2.0 or secure element

UplinkX25519MLKEM768

StatusIn development

The DCS OT Gateway is the reference platform for the OT/IoT line. It runs the gateway image: a Modbus tap, the S1 edge library, a transport bridge, a policy fence and a store-and-forward buffer. DCS owns the requirements and the image.

Its rule: the gateway consumes the R-Series engine and never implements cryptography. The TPM or secure element on the board authenticates the gateway, and the engine's custody path signs. The gateway code never holds raw key material.

The stages run from requirements to a ruggedised field unit. The reference gateway runs on an off-the-shelf industrial SBC with a secure element, or on the customer's own industrial PC or gateway. Every hardware revision gets its own CBOM.

What the hardware has to survive and carry.

ENVIRONMENT

Industrial temperature range

Cabinets in refineries, pump houses and substations are not air-conditioned. The board, storage and power supply must be rated for an industrial temperature range.

NETWORK

Dual Ethernet

One port for the cell or field VLAN (or the switch's mirror port), one for the WAN uplink. Field and WAN never share a port.

SERIAL

RS-485 / Modbus RTU

A great deal of the installed base still speaks Modbus RTU over a serial bus. The gateway needs an isolated RS-485 terminal to reach it.

CUSTODY ROOT

TPM 2.0 or secure element

A hardware root that authenticates the gateway and seals its identity.

PHYSICAL

Tamper evidence

An enclosure switch and seals, so that opening the box leaves a trace. A tamper event is something the gateway can report.

POWER + MOUNTING

Power budget, DIN rail

The unit runs within the cabinet's power budget and mounts on a standard DIN rail next to the controllers it serves.

From a list of requirements to a field unit.

DCS OT Gateway01 / 05

REQUIREMENTS

A spec envelope, nothing bought.

Gateway requirements (temperature, dual Ethernet, RS-485, custody root, tamper evidence, power) and bench requirements (simulators, at least one real industrial stack, network taps). The gate is sign-off of the requirements.

Planned

BENCH

A Pi-class board with a TPM HAT.

On the bench, a small single-board computer with a TPM 2.0 HAT and USB-RS485 adapters stands in for the gateway. The exit criterion is a scripted scenario reproduced twice, identically, plus a CBOM of the bench itself.

Planned

REFERENCE GATEWAY v0

Off-the-shelf industrial SBC + secure element.

The DCS gateway image in a DIN-rail enclosure, with the custody root reached only through the engine. The gate: an onboarding receipt checked by a non-author in JS and Python.

Planned

DCS-SPECIFIED BOARD

A carrier board for a module, set aside.

A DCS-specified carrier board was considered and set aside: DCS does not fabricate boards. The custody wiring requirement carries over to whatever off-the-shelf unit is chosen.

FIELD UNIT

Ruggedised, sealed, recoverable.

A ruggedised unit for the field pilot, with cable glands, tamper seals and remote recovery. The gate is the pilot site's acceptance.

Planned

Six jobs. None of them is cryptography.

01 · MODBUS TAP

Observe, never write

The gateway reads field traffic from the switch's mirror port and bridges the RS-485 bus. It does not write to the PLC: the bench requires zero PLC writes.

02 · S1 EDGE LIBRARY

A receipt per frame or batch

Observed Modbus frames are batched, and the engine mints a receipt through the S1 edge adapter. Receipts are designed to say where their evidence came from: inventory, observed in the path, or native to the path.

03 · HYBRID UPLINK

X25519MLKEM768 on the WAN

The WAN side negotiates hybrid key exchange through the system TLS stack. The device side keeps its legacy protocol. A degraded exchange is reported, and a downgrade is receipted.

04 · POLICY FENCE

An allow-list for the legacy VLAN

A device that cannot migrate is reachable only through the gateway. Direct attempts are blocked and receipted. A policy change is a governance receipt. Safety functions are never fenced.

05 · STORE-AND-FORWARD

Honest about gaps

When the uplink is down, receipts queue locally. On reconnect, the gateway issues a coverage statement saying exactly which period was buffered, with nothing papered over.

06 · FIRMWARE RELAY + CBOM

Relays, never re-signs

Signed images come from the air-gapped signer. The gateway passes them on, and the device verifies them. The gateway also emits CBOM fragments for each device it can see.

Three rules the hardware cannot bend.

RULE 1

No cryptography in gateway code.

Gateway code imports no crypto library, and a guard checks for it. Every signature, every hash commitment that matters and every key exchange is a call to the R-Series engine (S1).

RULE 2 · CUSTODY

Keys only through the custody path.

Device identity lives behind the engine's custody path, rooted in the TPM or secure element. Nothing goes into firmware or images. Provisioning the secure element is a ceremony, and it produces receipts.

RULE 3 · DEVICES

Devices verify only.

No signing key on any field device. Signer state stays in the air-gapped signer zone. The gateway mints receipts but never re-signs firmware.

The TPM authenticates, S1 signs. A key held in the TPM does not mint receipts directly. The registry would refuse it.

Every hardware revision has its own CBOM. The bench and every gateway revision get a cryptographic bill of materials, and a hardware one alongside it.

Stop criteria. Any step that needs cryptography outside S1, writes to the PLC or fences a safety function stops.

No production hosts. On the bench, the gateway talks only to R-Series staging and to itself.

From integrators and OT security teams.

Is the DCS OT Gateway a product we can buy today?

No. It is a reference platform in its requirements stage. The bench comes first, and a field unit only follows a named pilot.

Can it run on our existing industrial PC?

That is the intended path. The gateway is migration software that runs on a customer's industrial PC or gateway, or on an off-the-shelf industrial SBC. It needs dual Ethernet, RS-485 and a TPM or secure element.

Why no cryptography in the gateway code?

So that there is one trust boundary to certify. Every signature, verification and key exchange goes through the R-Series engine, which is what goes through certification. A second implementation inside a gateway would be a second thing to audit, and a second thing to get wrong.

What happens when the uplink drops?

Receipts are buffered locally. On reconnect, the gateway issues a coverage statement naming the exact interval that was buffered. Gaps are disclosed, never hidden.

Does the hybrid uplink make the plant post-quantum?

No. A hybrid key exchange protects the WAN leg against harvest-now-decrypt-later. It does not make the devices or the plant post-quantum, and we make no such claim.

The gateway that migrates a plant.

Migration software on reference hardware.

What the hardware has to survive and carry.

Industrial temperature range

Dual Ethernet

RS-485 / Modbus RTU

TPM 2.0 or secure element

Tamper evidence

Power budget, DIN rail

From a list of requirements to a field unit.

A spec envelope, nothing bought.

A Pi-class board with a TPM HAT.

Off-the-shelf industrial SBC + secure element.

A carrier board for a module, set aside.

Ruggedised, sealed, recoverable.

Six jobs. None of them is cryptography.

Observe, never write

A receipt per frame or batch

X25519MLKEM768 on the WAN

An allow-list for the legacy VLAN

Honest about gaps

Relays, never re-signs

Three rules the hardware cannot bend.

No cryptography in gateway code.

Keys only through the custody path.

Devices verify only.

Where the gateway stands.

From integrators and OT security teams.

Every gateway claim is proved on the bench first.