What are edge nodes?

edge nodes in it ot architecture explained audience this document is intended for stakeholders without a technical background it explains what edge nodes are, why they are used in a manufacturing environment, how they contribute to cybersecurity, and where they are typically installed edge nodes are the secure bridge between the machines on the shop floor (ot) and software platforms such as the mantsu mes (it) they collect, translate, and forward machine data without exposing the ot network the challenge two worlds that need to communicate modern manufacturing operates in two distinct worlds that have very different characteristics and priorities the ot world (operational technology) is the world of machines, controllers, sensors, and production lines its priority is reliability and continuity a machine controller that hesitates for even a fraction of a second can disrupt production or create a safety issue ot equipment is often decades old, runs specialised software, and was never designed to be connected to a broader network the it world (information technology) is the world of business applications, databases, enterprise software, and cloud services it is designed for flexibility, updates, and connectivity it systems expect to communicate over modern protocols and are regularly updated and patched connecting these two worlds directly is risky ot equipment is often too fragile to be exposed to it level network traffic, and it networks are too open to be trusted from a production safety perspective the edge node sits between the two and manages this boundary what is an edge node? an edge node is a small, dedicated computing device placed close to machines and production equipment it acts as an intelligent intermediary between the ot world and the it world it collects data from machines, processes it locally, and forwards selected results to enterprise systems think of it as a local translator and gatekeeper machines speak their own language over their own protocols enterprise systems speak a different language over different protocols the edge node translates between the two, decides what information is worth forwarding, and ensures that communication flows in a controlled way graph lr subgraph ot\["🏭 ot world (shop floor)"] m1\[machine controller] m2\[sensor array] m3\[plc / scada] end subgraph edge\["⚙️ edge node"] c\[collect] p\[process & filter] f\[forward] c > p > f end subgraph it\["🏢 it world (enterprise)"] broker\[message broker] mes\[mes application] cloud\[cloud / data platform] end m1 >|raw data| c m2 >|raw data| c m3 >|raw data| c f >|selected, processed data| broker broker > mes broker > cloud why do we use edge nodes? 1\ processing data where it is generated machines produce enormous volumes of raw data a single production line may generate thousands of readings per second sending all of that raw data to an enterprise system would overwhelm the network and make the receiving system responsible for making sense of it all the edge node processes data locally, close to the source it calculates averages, detects anomalies, and filters out noise before anything leaves the shop floor only meaningful, structured information is forwarded upward this keeps network traffic manageable and ensures that enterprise systems receive clean, relevant data 2\ continuing to operate when the network is unavailable enterprise networks can experience outages a direct connection between a machine and a cloud platform means that any network interruption immediately breaks the data flow in some architectures it could even affect machine operation the edge node operates independently it has its own local storage and continues collecting and processing data even when connectivity to the enterprise is lost once the connection is restored, it synchronises the data that accumulated during the outage production is never dependent on an enterprise network being available 3\ reducing the delay between event and response some decisions need to happen in milliseconds if a machine temperature exceeds a safety threshold, waiting for a signal to travel to the cloud and back before triggering an alert is not acceptable the edge node can apply local rules and trigger local responses instantly, without any round trip to the enterprise 4\ translating between ot and it protocols ot equipment communicates using industrial protocols such as opc ua, modbus, or profinet enterprise systems use modern it protocols such as mqtt or kafka the edge node handles this translation, allowing old and new systems to coexist without requiring costly modifications to the machines themselves graph td subgraph protocols\["protocol translation at the edge"] opc\[opc ua from machine controller] mod\[modbus from sensor] pro\[profinet from plc] en\[edge node] mqtt\[mqtt to enterprise broker] opc > en mod > en pro > en en > mqtt end how is cybersecurity applied? the edge node is one of the most important elements in a secure it ot architecture its position at the boundary between the two worlds means that it can enforce strict rules about what is allowed to cross that boundary, in which direction, and under what conditions the boundary principle one direction only the most fundamental security rule is that data flows from ot to it, not the other way around machine controllers and sensors send data outward to the edge node enterprise applications receive data from the enterprise side of the architecture no enterprise application ever sends commands or data directly into the ot network through the edge node this is sometimes called a unidirectional gateway just as a one way valve in a pipe allows fluid to flow in only one direction, the edge node allows data to flow outward from the machines but blocks anything attempting to flow inward from the it network graph lr subgraph ot\["🏭 ot network"] machines\[machines & controllers] end subgraph edge\["⚙️ edge node"] gw\[unidirectional\ngateway] end subgraph it\["🏢 it / enterprise network"] apps\[enterprise applications] end machines >|data flows outward| gw gw >|processed data forwarded| apps apps "blocked no inbound access\nto ot network" > gw style apps fill #f9f9f9 keeping ot equipment off the open network ot equipment was never designed to be reachable from the internet or from a broad corporate network connecting a machine controller directly to an enterprise network exposes it to threats it has no way to defend against network scans, login attempts, software exploits many ot devices run software that is years or decades old and cannot be patched the edge node absorbs this risk it is the only device that communicates with both sides the machines behind it are invisible to the it network an attacker who gains access to the enterprise network cannot reach the machines directly, because the edge node does not provide that path encrypted communication all communication between the edge node and enterprise systems is encrypted this means that even if someone intercepts the data in transit, they cannot read or modify it the edge node and the enterprise broker authenticate each other using digital certificates before any data is exchanged, ensuring that only authorised devices can participate in the communication controlled software and updates the software running on the edge node is managed centrally and updated in a controlled way unlike ot equipment, which may run the same firmware for years, the edge node can receive security patches and configuration updates without touching the machines behind it this keeps the boundary between ot and it up to date with current security standards separation of roles the edge node reinforces the separation of responsibilities between the plant team and the corporate it team the plant team manages everything on the ot side the machines, the local network, and the edge node's connection to those machines the corporate it team manages everything on the enterprise side the broker, the applications, and the network the edge node connects to neither team has unrestricted access to the other's domain, and the edge node enforces this boundary in both directions graph td subgraph plant\["🔒 plant responsibility"] ot net\[ot network] machines2\[machines & sensors] en2\[edge node ot side configuration] end subgraph corp\["🏢 corporate it responsibility"] en it\[edge node it side configuration] broker2\[enterprise broker] apps2\[enterprise applications] end machines2 > ot net > en2 en2 >|"controlled boundary"| en it en it > broker2 > apps2 where are edge nodes installed? edge nodes are placed at the points in the architecture where ot and it systems need to exchange data the right placement depends on the scale of the plant, the number of machines, and how data needs to flow at machine or cell level in environments where individual machines or small groups of machines (cells) need to be connected, an edge node is placed directly beside the equipment it serves it collects data from one machine or a handful of machines on a single production cell and forwards it to the plant network or directly to a plant level broker this level of placement gives the finest control each machine group has its own isolated edge node, and a problem with one does not affect others at line or area level in larger environments, a single edge node may serve an entire production line or a defined area of the plant it aggregates data from all the machines on that line, applies local processing and filtering, and forwards a unified stream to the plant broker this is the most common deployment pattern it balances granularity with manageability enough isolation to contain issues, but few enough devices to be practical to maintain at plant level (dmz) a plant level edge node sits at the boundary between the plant network and the enterprise network, typically in a dmz (a neutral network zone that sits between the two) this node is the single exit point for all data leaving the plant toward the enterprise it enforces the unidirectional communication rule and is the point at which plant level data is consolidated before being promoted to the enterprise broker in a multi plant architecture, each plant has its own plant level edge node the enterprise broker collects from all of them graph td subgraph cell\["machine / cell level"] m a\[machine group a] en a\[edge node a] m a > en a end subgraph line\["line / area level"] en a > en line\[line edge node] en b\[edge node b] > en line end subgraph plant\["plant level (dmz)"] en line > en plant\[plant edge node in dmz] end subgraph enterprise\["🏢 enterprise"] en plant > eb\[enterprise broker] end key takeaways edge node placement level serves typical location machine / cell one machine or a small group on or beside the machine line / area a full production line or plant zone local control cabinet or server room plant (dmz) the entire plant network dmz, boundary between plant and enterprise frequently asked questions what do edge nodes do in a mantsu architecture? they sit in the ot network, translate machine protocols into mqtt topics, and push that data outward into the mantsu uns which edge technologies does mantsu use? node red as the edge connector for smaller plants, or flowfuse where many edge instances need centralized management, both publishing to the mqtt broker where are edge nodes installed in a mantsu plant? in the ot network close to the machines and controllers, at machine/cell, line/area, or plant dmz level depending on the scale of the plant summary edge nodes sit in the ot network, translate machine protocols into mqtt, and push data outward without ever accepting inbound connections they are the secure, scalable bridge between the shop floor and mantsu