Security Guidelines¶

This document describes the security measures and operational responsibilities relevant to C-Gate. C-Gate is intended to run in a customer-controlled company network and to be used with CLOOS QIROX robots and QINEO welding machines.

Hosting Environment¶

• Host C-Gate IoT Hub and C-Gate IoT Connector inside the customer company network. Do not publish them directly to the public internet.
• Use the C-Gate IoT Connector as the boundary between the company network and the internal CLOOS machine network. See C-Gate infrastructure for the supported topologies.
• Prevent unauthorized physical access to the IoT Connector in the control cabinet. For a Hub installed in a virtual machine, protect the host, the VM, and the Hub container against unauthorized access.
• Restrict access to the Hub, Connector, container runtime, VM, and persistent data to authorized administrators. Use the customer organization's access-control, backup, monitoring, and hardening procedures.

Software Updates¶

C-Gate Hub and Connector updates are released regularly. Before release, the application, containers, and container images are scanned for known CVEs. Previously released versions are scanned regularly as well.

Updates are covered by more than 4,000 automated tests and are validated with pilot customers before release. New updates are announced by notifications in the Hub and Connector interfaces. Review the changelog and follow the Hub update procedure.

Connector to Hub Communication¶

Use an encrypted connection wherever possible. Avoid unencrypted connections, especially across networks that are not fully trusted.

For HTTPS, the customer may provide its own Hub certificate by placing the files in the Hub data volume:

/data/security/hub/server.crt
/data/security/hub/server.key

Connector Authentication¶

• For HTTPS connections, the Hub certificate is displayed in the Connector settings and must be accepted there.
• For HTTPS and RPC connections, the Connector must be allowed on the Hub by assigning it to a device. Devices are added by uploading a license to the Hub.
• Verify that the intended Connector is being authorized by comparing the fingerprint shown on the Hub with the fingerprint shown in the Connector settings.

Hub Behind an HTTPS Reverse Proxy¶

An HTTPS reverse proxy can terminate TLS with a customer-managed certificate. Set APP_EXTERNAL_URL to the public URL, for example https://c-gate.my-company.com. Configure the proxy to support WebSockets and forward these headers:

• X-Forwarded-For
• X-Forwarded-Proto
• X-Forwarded-Host
• X-Forwarded-Port

See HTTPS reverse proxy for configuration details and examples.

Secure OPC UA Server¶

The OPC UA server uses APP_EXTERNAL_URL when generating its certificates. If the OPC UA endpoint needs a different URL, set APP_EXTERNAL_URL_OPC_UA, for example opc.tcp://opcua.c-gate.my-company.com:4840.

The external OPC UA port must match the internal port so that the generated endpoints match. If the external port is different from the default, set APP_OPC_PORT to the external port as well.

Firewall and Ports¶

Open only the ports required for the configured C-Gate functions. Refer to Hub firewall settings and Connector firewall settings for the current port requirements.

Factory Reset¶

A factory reset permanently deletes all machine data and personal data stored on the Connector. Perform a factory reset only when the data is no longer required and follow the applicable Connector procedure.

Reporting Security Issues¶

Report suspected security vulnerabilities according to the CLOOS Coordinated Vulnerability Disclosure Policy.