Architecture and security
The Sybox never connects to your site’s IT network. Here is where measurements go and where they are kept.
The path data takes, from the machine to the information system
The machine, fitted with a Sybox
Unit magnet-mounted on the machine, powered on site, carrying its own SIM card.
BLEThe Syway speaks BLE to the Sybox, and to nothing else
Syway: remote sensor, optional
- LTE-M
The Sybox transmits over LTE-M, through its SIM card
The mobile operator’s network
Traffic travels over the operator’s cellular network, not over the site’s local network.
The operator carries the measurements through to the platform
The Sycon platform
Measurements are received, kept and processed here.
- HTTPS
The client opens the connection and comes to fetch their own data
The client’s information system
The client’s own workstations consult the platform, or pull data from it.
A measurement leaves the machine, crosses the mobile operator’s network and reaches the platform. The site network is never on the path.
No arrow on this diagram points into the client’s site: nothing there is opened from outside.
The path of a measurement
The Sybox measures the machine it is fitted to and sends its readings over the LTE-M cellular network, that is, straight to the mobile operator. It carries its own SIM card. It has no address on your local network, it does not cross it, and it opens no port on it.
When a remote measurement module is fitted (a Syway and its current clamps), it sends its readings over Bluetooth to the nearby Sybox, which passes them on with its own. The path does not change: nothing leaves through your network.
What fitting does not require
There is no cabling to run, no gateway to install, no firewall rule to write, no address range to reserve, no account to open.
This is also what makes sequential deployment possible: you start with one machine and extend later, machine by machine, without either step calling for an infrastructure project.
Why a cellular network rather than a very-low-bandwidth one
A network designed to carry a few bytes at a time cannot update a unit remotely. LTE-M has the bandwidth for it. The difference is not one of convenience: an industrial connected device must be able to receive its security fixes throughout its service life, and a sensor that cannot be updated is a sensor that will have to be replaced.
Cyber Resilience Act Ready
That is what the wording covers: an architectural choice. The Sybox does not attach to your network, it receives its security fixes remotely throughout its service life, and its start-up is verified by certificate.
What the Sybox is not
It is not cut off from the world: it communicates, and it does so continuously. What it is cut off from is your network. That distinction is what matters to a security officer: the surface it exposes on your information system is nil, because it is not on it.