Methods and systems for providing data from an internal data processing system of an industrial plant to an external data processing system

An industrial network comprising an internal data processing system of an industrial plant and an external data processing system external to the industrial plant, wherein the internal data processing system comprises a plurality of industrial edge devices each having at least one data processing module and a user-defined data filter, and a plurality of industrial machines, wherein each single industrial edge device is associated with a different single industrial machine, wherein each one of the industrial edge devices is adapted to

• generate a plurality of data packets from data related to each of the associated industrial machines, and
• with each of the industrial edge devices, sign each data packet of the plurality of data packets with a first digital signature, thus producing a plurality of signed data packets,
• with each of the data processing modules and user-defined data filters,
• read each signed data packet of the plurality of the signed data packets and, while reading, apply the at least one user-defined data filter to each signed data packet to determine if each of the signed data packets contains sensitive data and/or confidential information;
• let through those signed data packets that contain no sensitive data and/or confidential information and pass the user-defined data filter and send all those data packets that have passed the user-defined data filter towards the external data processing system;
• reject those signed data packets that contain sensitive data and/or confidential information and fall to pass the user-defined data filter and not forward further the rejected signed data packets so that the rejected signed data packets remain within the internal data processing system;
• and
• produce double-signed data packets by signing the signed data packets that pass the user-defined data filter with a second digital signature.

A computer program stored on a non-transitory computer-readable medium and comprising instructions which when stored in a memory of an internal data processing system of an industrial plant comprising a plurality of industrial edge devices each having at least one data processing module and a user-defined data filter, a plurality of industrial machines, wherein each single industrial edge device is associated with a different single industrial machine, and executed by a processor of the internal industrial data processing system, causes the internal industrial data processing system to

• provide data from the internal data processing system to an external data processing system external to the industrial plant,
• with each of the industrial edge devices, generate a plurality of data packets from data related to each of the associated industrial machines,
• with each of the industrial edge devices, sign each data packet of the plurality of data packets with a first digital signature, thus producing a plurality of signed data packets;
• with each of the data processing modules and user-defined data filters,
• read each signed data packet of the plurality of the signed data packets and, while reading, apply the user-defined data filter to each signed data packet to determine if each of the signed data packets contains sensitive data and/or confidential information,
• let through those signed data packets that contain no sensitive data and/or confidential information and pass the user-defined data filter and send all those data packets that have passed the user-defined data filter towards the external data processing system;
• reject those signed data packets that contain sensitive data and/or confidential information and fail to pass the user-defined data filter and not forward further the rejected signed data packets so that the rejected signed data packets remain within the internal data processing system;
• and
• produce double-signed data packets by signing the signed data packets that pass the user-defined data filter with a second digital signature.