Security Gateway
Enforce secure segregation of critical rail networks and cut your exposure to cyber attack, on new and refurbished fleets.
What it does
Security Gateway sits between key areas of the on-board network and enforces segregation, so train operators, builders and OEMs can manage secure zones and conduits without reliance on individual system suppliers.
It is a Layer 7 firewall with rail protocol support: it filters and inspects traffic crossing zone boundaries. For visibility inside each zone, pair it with Delta, which monitors devices and traffic within the zones. Deploy Security Gateway as an EN 50155 compliant hardware appliance, or as software on approved existing hardware.
Security Gateway is in service on new-build and retrofit rail programmes.
Key benefits
Inspect traffic between zones
Deep packet inspection and Layer 7 rail-protocol filtering control what crosses each security boundary.
Combine security functions on one platform
Host Delta intrusion detection and other security applications as isolated modules alongside boundary enforcement.
Control configuration across the fleet
Configuration-as-code, controlled over-the-air updates and safeguarded rollback make changes easier to manage and audit.
Meet the operator’s specification
Select the deployment and filtering controls against the fleet architecture, risk assessment and OEM requirements.
Key capabilities
Network segregation
Separate on-board zones and control the traffic that crosses between them.
Protocol filtering
Apply Layer 7 inspection and rail-protocol filtering at zone boundaries.
Hardware or software deployment
EN 50155 compliant appliance, or software on approved existing hardware.
Central log aggregation
Syslog feeds into your SOC/SIEM for fleet-wide correlation.
Hardened application platform
Secure boot and disk encryption protect the platform, which can also host Delta as an isolated service module. Security Gateway is designed to stay in service for 15 years, with maintenance and updates throughout that period.
Configuration management
Configuration-as-code with selective over-the-air updates, A/B partitioning and safeguarded rollback.
Enforce at the boundary
Security Gateway is the enforcement layer of The Secure Train: it separates onboard zones and filters the traffic that crosses between passenger, comfort, TCMS and safety-related environments.
See the full architecturePlan your integration
A technical workshop pack covering interface, environmental and performance detail is available on request.
Request a technical workshop
