Trusted Access Protection
Devices that cannot run a security client can still connect securely
No client on the device — how do you let it connect securely?
For complex network environments such as industrial sites, workshops, service halls, campuses and branch outlets: non-intrusive access, device fingerprinting, business learning with network self-adaptation, and allowlist access control build a trusted access and secure communication system — without changing existing devices or business.
- No device changes
- No agent
- No business impact
- Identifiable access
- Controlled access
What if devices cannot run a client?
In an office network, endpoints can run a security client.On the production floor, many devices simply cannot.
- PLC
- Industrial equipment
- Dedicated terminals
- Headless terminals
- Video surveillance
- Printers
- Self-service devices
Typical constraints:
- A security client cannot be installed
- The operating system must not be modified
- Old system versions
- No security agent from the vendor
- Many devices and models
- Modifying devices may disrupt business
These devices must be networked,yet cannot be protected the way traditional endpoints are.
Once connected, the questions that really matter are:
- Who is this?
- What should it access?
- Is its current access normal?
- What if a different device plugs in?
No device changes — build trusted access from the network side
Identify → Learn → Judge → Control
Trusted Access Protection does not require a client on the device,nor any change to existing business systems.Security capabilities at the network access edge continuously identify devices and analyze their access.
- Device identificationIdentify device identity, hardware/software traits and network attributes
- Business learningLearn real communication relations and build a business access baseline
- Trust judgmentJudge by device identity, business relations and access behavior
- Access controlControl access by allowlist, alert, isolation and blocking
Devices identifiable, business understood, access controlled, anomalies discoverable.
Deployment mode and device coverage depend on the site network architecture and technical validation.
Industrial Sites / Headless Terminal Access
For plants, workshops, service halls and campuses: secure access and access protection for headless terminals and dedicated devices that cannot run a security client.
- Plant / Workshop
- Service hall / Outlet
- Campus
- Industrial devices
- Headless terminals
Many scenarios · Many terminal types
Industrial sites
- DCS/SCADA
- Engineer station
- Inspection device
Workshop lines
- HMI
- Industrial robot
- PLC / controller
Service halls / Outlets
- Self-service kiosk
- POS terminal
- Digital signage
Campus / Other
- Access control
- Video surveillance
- Other devices
Business systems(any type, connected on demand)
- MES
- ERP
- SCADA
- Video surveillance
- Energy management
- Other systems
Device access(multiple access methods)
- Access gateway / Secure access device(network protection / access control / protocol parsing)
- TiSEC Trusted Access Protection Platform(device authentication / access control / security audit)
- Private / Industrial network(intranet / private line / IoT)
Protection & control
- Device admissionIdentify device type and state
- Access controlPolicy-based fine-grained control
- ProtectionBlock illegal access and threats
- Behavior auditRecord access and operations
Business system integration
- Industrial controlMES / SCADA / DCS
- Enterprise managementERP / OA / CRM
- Video surveillanceVideo platform / storage
- Energy managementConsumption / metering / monitoring
- Other systemsIntegrated on demand
Secure access · Value
- Devices identifiedKnow terminal type and access state
- Access controlledFine-grained control by policy
- Risks protectedBlock abnormal access and malicious behavior
- Process auditedKeep operation logs and audit records
A device arrives — know it first
Non-intrusive device identification
No agent on the device,no change to the device system —devices and their traits are identified from the network side.
Suitable for:
- PLC
- Industrial equipment
- Dedicated terminals
- Headless terminals
- IoT devices
- Video surveillance
- Self-service devices
Turn device access from:“an IP address”
into:“a device with identity and traits”
Identification capabilities
Non-intrusive identification
No change to devices or their running environment.
Device identity
Identify device type and network attributes.
Continuous awareness
Keep track of access state and identity changes.
Anomalous device discovery
Spot unknown, replaced or abnormal devices promptly.
Not just the IP — the device itself
Hardware & software fingerprinting
IP addresses change,but a device’s own traits are far more stable.
A device fingerprint is built from hardware, software, network and communication traits.
When a device is replaced, spoofed or changes abnormally, the identity change is detected promptly.
From “trusted IP” to “trusted device”
- Device fingerprintIdentify device traits
- Identity bindingBind the device to its network identity
- Continuous verificationDetect abnormal changes
- Trust judgmentDecide whether to allow access
Understand the business first, then set the policy
Business learning & access baseline
Communication at complex sites is not a simple “allow / deny”.
Devices have many real business relationships:
- Production equipmentControl server
- Service terminalBusiness system
- Dedicated deviceDesignated service
- Field deviceManagement platform
By continuously learning normal communication relations, the system gradually builds an access baseline between devices and business.
Base security policy on real business
- See devices
- Understand traffic
- Grasp business relations
- Form the baseline
- Detect abnormal access
Business changes — so must policy
Network self-adaptation
A real business environment never stands still.
New devices, system changes and server changes all create new normal communication relations.
By continuously learning business changes, the platform keeps its understanding of normal access up to date.
- Avoid:Policy too strictdisrupts normal business
- And avoid:Policy too loosecannot protect effectively
Let security control follow business operation
- Learn
- Judge
- Control
- Learn again
Continuously forming access policy that fits the real business environment.
Allow what should be allowed, control what should not
Allowlist access control
A trusted access allowlist is built from device identity, hardware/software fingerprints, business relations and access behavior.
From the traditional:“devices on the network can reach each other by default”
to:“only access that matches a trusted relationship passes”
Fine-grained access relations
- WhoIs the device identity trusted?
- From whereDoes the access location meet requirements?
- To whomDo target devices and systems match the business relation?
- To whatDo services, ports and behavior match policy?
- Allow?Allow, alert, isolate or block
Security is not one-size-fits-all
Keep business running, expose anomalies early
At complex sites,a blunt “allow all” or “deny all” rarely works in practice.
Trusted Access Protection starts from the actual business:
- Normal device + normal businessNormal access
- Known device + abnormal accessAlert / control
- Unknown device + unauthorized accessBlock / isolate
- Device identity changedRe-verify
Moving security policy from fixed rules toward dynamic control based on device identity and business relations.
From “invisible” to “identifiable and controllable”
A trusted access system for field devices
| Traditional network | Trusted Access Protection |
|---|---|
| Only IP addresses are visible | Device identity is recognized |
| Devices cannot run an agent | Non-intrusive network-side protection |
| Rules configured manually | Business learned automatically |
| Fixed access policy | Network self-adaptation |
| Open by default | Fine-grained allowlist control |
| Device changes go unnoticed | Continuous identification and verification |
| Abnormal traffic is hard to judge | Anomalies found against the business baseline |
For many kinds of devices at complex sites
Industrial production sites
PLCs, industrial control devices, production equipment, dedicated terminals.
Control network access without changing devices.
Service halls
Queue machines, rating terminals, self-service kiosks, printers.
Identify and manage large numbers of devices uniformly.
Campuses / Outlets
Access control, cameras, IoT devices, dedicated terminals.
Bring trusted access to many unattended devices.
Power and key industries
Production control, dedicated equipment and complex networks.
Strengthen access control without affecting existing business.
Core capabilities
Non-intrusive identification
No agent; identify device identity and network traits from the network side.
Fingerprint control
Combine hardware, software and network traits to spot identity changes and abnormal devices.
Business learning
Continuously learn real communication relations and build the device–business access baseline.
Network self-adaptation
Adjust the access baseline as business changes, lowering the cost of manual policy upkeep.
Allowlist control
Fine-grained network access control based on trusted devices and business relations.
Anomaly discovery & response
Find unknown devices, abnormal access and identity changes; alert, isolate or block.
One simple outcome
Before, all we saw was “a device connected”.
Now we can tell:
- Who is this?Whether the device identity is trusted.
- What should it access?Whether its business access relations are normal.
- What is it doing now?Whether its traffic matches the business baseline.
- What if something is wrong?Alert, isolate or block.
Trusted Access Protection
Every device: access with identity, access within boundaries, behavior with evidence
- Non-intrusive deployment
- Trusted device identification
- Self-learning business
- Network self-adaptation
- Allowlist access control
Starting from device access, build a trusted network access system for complex sites.
Devices that cannot run a security client can still connect securely.