Beyond Purdue / L2 Channels
Channels: the gate between levels
L2 Channels are the gatekeeper: every level speaks to every other level only through a channel. Out channels carry data out, in channels carry commands in, and the two never mix.
L2 is the ring. Every level communicates with the others only through L2 channels. Protection sends its records through a data diode into the data plane, and from there they are available to the operator and other systems. The operator sends commands through an L2 in channel, with its own diode, down to the controller. Remote access, vendors and the enterprise also enter only through L2.
Two planes
The record plane is wide and flows out only: everything is recorded. The command plane is narrow and one-way in: few paths, every command stamped with who issued it and from which level, never in the same channel as data.
The data diode is the enabler
The isolator lets light pass one way only, so data and commands cannot mix. A passive data diode has no power, no firmware and nothing to configure, so it is as predictable as a relay or a padlock, and it is named like any other asset [24][25]. Restricted data flow between zones and conduits is the language of IEC 62443-3-3 [26].
Channels never originate an action. They decide only what crosses, and in which direction.
How the passive diode works is on The passive data diode. The law behind the channels is the Fourth Law on The Laws of Authority.
Sources
- NIST glossary, data diode. https://csrc.nist.gov/glossary/term/data_diode
- NIST SP 800-82r3, Guide to Operational Technology Security. https://csrc.nist.gov/pubs/sp/800/82/r3/final
- IEC 62443-3-3, System security requirements and security levels. https://webstore.iec.ch/en/publication/7033