Industrial Wireless

Configuring secure wireless LAN access to the machine network

November 2017 Industrial Wireless

The completely networked machine is at the centre of digitalisation and the concepts of Industrie 4.0. But how can such a highly communicative application be designed securely? With the wireless module WLAN 1100, Phoenix Contact provides an access point that carries out this task in a user-friendly way.

In the past, protecting the machine network against malware and harmful actions proved to be simple: it was operated as a local island, to which only a restricted group of people needed access. In contrast, many people can access the networked machine, which is why new secure access concepts are required. The challenges and their solution can be seen in the example of wireless LAN access to the machine network for communication with smart devices, such as a tablet PC.

A wireless LAN password is not sufficient for numerous users

Most network devices allow access protection through user authentication via a common device password. A secure password such as this provides a high degree of protection, however, the generation of an appropriate password as well as secure documentation for it, is a burden for the machine operator. Since users often assume that access to the network is protected mechanically, they frequently lack the sensibility for problems in practice. This can be seen in network devices that are usually protected only by the password provided by the manufacturer, or a simple default password specified by the engineer. This statement often also applies to the wireless LAN password (WPA-PSK) that protects access through the WLAN access point to the machine network. Therefore, anyone who knows the passwords, or knows where they are stored, has free access to all devices in the network.

The machine control system manages the automated network administration

In an IT network, individual passwords are assigned to users by an administrator and distributed to the network devices by a server. If the access rights of a user change, the administrator specifies this in the central server. Machine networks are not usually maintained by network administrators. As a rule, the user rights and passwords once configured remain unchanged and valid for the complete duration of the use of the machine. In connection with this, the implementation of IT services, such as the integration of a radius server into the machine, also does not provide a solution, as it is not maintained by one administrator.

The challenge depicted can be bypassed by automating the network administration and having it carried out by the machine control system. Such an approach is not only cost-neutral and practical, but furthermore enables the engineer to have full control and flexibility in its implementation. An important prerequisite, however, is that the network device – in this case, the WLAN access point – includes an interface through which the machine control system can be controlled at the runtime. Phoenix Contact has therefore installed a web API interface into its network components that have been specially developed for machine building. Individual functions of the network devices can be controlled by sending HTTP-GET messages at the runtime. Furthermore, the complete module can be configured easily by the machine control system. The syntax of the commands thereby corresponds to the standard Command Line Interface (CLI). The new switches of the product range FL Switch 2000, as well as the WLAN access point of the series WLAN 1100, have such an interface.

One-time password generated with every connection established

The user who would like to connect with the machine network with their tablet PC registers their access request, for example, using the operation and monitoring terminal. The control then generates a random one-time password. It then configures and activates a virtual access point in the WLAN 1100 by HTTP-GET message. The one-time password to the new WLAN network is allocated to the user subsequently using the operation and monitoring terminal. If the user no longer needs the connection, the controller deactivates the virtual access point. Knowledge of the WLAN password as well as automatically storing it in the tablet PC is therefore no longer a security risk because a new one-time password is created and used the next time a connection is established.

The WLAN 1100 provides additional options for simple and secure access to the machine network. Therefore, up to two virtual access points can be established with individual WLAN security settings simultaneously. In addition to a unique WLAN password, the machine operator can use a configurable IP filter to limit the number of simultaneous connections for each point of access as well as limit the access to the network to the installed devices. In this way, it provides complete network access for the service engineer and simultaneously access, for example, for the machine operator who may only be permitted to view the visualisation server. Furthermore, a port-based DHCP server allocates individual and independent IP addresses to the WLAN clients for every virtual WLAN access point.

Web API interface is integrated into the components

The number of users who must have access to the devices installed in their network also increases due to the networking of the machine increasing. To this end, a security concept is required for allocating user rights and managing passwords. In contrast to IT networks, the machine control system can manage the administration of passwords and user rights in the network in an automated way. However, the network components at runtime must be able to be controlled by the machine control system via a simple interface. The switches of the product range FL Switch 2000, as well as the access points of the series WLAN 1100, provide an appropriate web API interface as new network devices for machine building.

MIMO technology always provides good reception

The new WLAN 1100 wireless module from Phoenix Contact combines access point and antenna technology in just one device. In contrast to the classic concept, it is installed like an antenna directly onto machines, mobile vehicles or control cabinets, rather than inside the control cabinet. Two integrated high-performance antennas with MIMO technology ensure good reception wherever it is needed. The WLAN 1100 enables both a cost-effective and simple WLAN connection of the machine. There is no need for expensive wireless planning or installation of antenna technology.

Because no space needs be reserved in the control cabinet for the wireless module, it can be retrofitted without difficulty. The WAN 1100 is attached using single-hole mounting and connected in the usual way with a Combicon connector and RJ45 Ethernet connector. The wireless module is suitable for rough industrial environments, as it is shockproof in accordance with IK08 and therefore even withstands stronger mechanical loads.

For more information contact Sheree Britz, Phoenix Contact, +27 (0)11 801 8200,,


Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

Adroit brings M2M, IoT and IIoT to the industrial world
June 2019, Adroit Technologies , Industrial Wireless
Combining the new IIoT capability with GIS interfaces, situational awareness and alarm management data, all can use the big data and analytical processing capability of Adroit's standard scada Intelligence software package to derive greater insights and value from their processes.

UPS with integrated power supply and USB interface
June 2019, Phoenix Contact , Electrical Power & Protection
Supplying critical DC loads safely, increased system availability, confined spaces, and tough ambient conditions present system designers and operators with a variety of challenges.

Wireless networks for AGV systems
June 2019, RJ Connect , Industrial Wireless
In order for factories to perform their tasks efficiently and optimise production, automated material handling (AMH) systems, such as AS/RS and AGVs, need the flexibility to move around on their designated ...

Merging control and telemetry
June 2019, Omniflex Remote Monitoring Specialists , Industrial Wireless
Wireless telemetry and control in plants have become a necessity with the data acquisition requirement of modern plant control to lift performance and compliance. In-plant cabling costs often push the ...

Managing complexity in wireless environments
June 2019, Axiz , Industrial Wireless
In the decades since its infancy, wireless networking has undergone tremendous shifts, opening an avenue for enterprise wireless Internet consumption. The advances in speed, coupled with the sheer convenience ...

Interference-free transmission with the Ethernet media converter
June 2019, Phoenix Contact , Fieldbus & Industrial Networking
The new FL MC EF 660 SCRJ media converter from Phoenix Contact enables the connection of cost-effective polymer and HCS/PCF fibre technology. The optical transmission of data via fibre optics is free ...

Mobility for Industry 4.0 ­challenges
Africa Automation Fair 2019 Preview, Pepperl+Fuchs , Industrial Wireless
The Tab-Ex 02 series of tablets from Pepperl+Fuchs has innovative features that make Industry 4.0/IIoT applications easy to implement.    The DZ1 version ecom has a range of applications that are unique ...

Hazardous area access point
Africa Automation Fair 2019 Preview , Industrial Wireless
Bartec’s Wireless X is a small, light wireless access point, eliminating the need for bulky, heavy enclosures and external antennas. On show at Stand G13, it has both IECEx and ATEX Zone 1 certification. ...

IIoT gateway for access to remote industrial equipment
Africa Automation Fair 2019 Preview, Throughput Technologies , Industrial Wireless
SiteManager is a security certified IIoT Edge Gateway in the Secomea Industrial Communications Solution program that ensures unified, uninterrupted and secure access to remote industrial equipment. Visit ...

Responsive wireless I/O from ­Omniflex
May 2019, Omniflex Remote Monitoring Specialists , Industrial Wireless
Radio networks traditionally follow the Master (main station node) and Slave (out station node) methodology for data acquisition. A single master polls for data from one or more slaves, depending on the ...