Sharing custody transfer metering data between organizations without connecting their OT networks

Industrial data increasingly has to move between separate organizations: producers, pipeline operators, downstream customers, equipment manufacturers and service providers.

Custody transfer metering is a typical example. Meters and flow computers at custody transfer points measure what changes hands between parties. These measurements are commercially sensitive and subject to legal and regulatory requirements, and every party needs timely, trustworthy access to them to reconcile volumes, nominations and invoices.

This use case shows how OPCNet Broker® DA HDA AE, combined with OPC Data Transfer and data buffering in each DMZ, enables secure OT-to-OT metering data exchange between organizations.

Each party owns its own OT (operational technology) environment, network architecture and security policies, and is responsible for protecting its own systems. Metering systems have traditionally been isolated, and their OPC (Open Platform Communications) interfaces were never designed for external exposure.

Opening those interfaces to partners, or directly connecting two operators' networks, adds cybersecurity risk that most organizations will not accept.

The data therefore had to be shared in a controlled way, where:

1. Each party sees only the data it is entitled to
2. The exchange is secure and traceable
3. Neither side needs inbound access to the other's OT network
4. Data is buffered during a temporary link outage and delivered when the connection returns.

OPC tunneling with OPCNet Broker® is the core building block for secure data transfer between organizations. Combined with a DMZ (demilitarized zone) based architecture, OPC Data Transfer and OPC Buffer, it establishes OPC communication between systems that belong to different organizations without any direct DCOM (Distributed Component Object Model) connectivity between them.

The OPCNet Broker® Client Side and Server Side establish the communication path across the agreed network boundaries, subject to each organization's firewall rules and security policies. Connectivity is restricted to the configured TCP (Transmission Control Protocol) port and approved endpoints, and application whitelisting and tag security limit access to the data points the receiving party is entitled to.

Organizations exchange the agreed industrial data without ever creating a direct network connection between their OT environments.

Three organizations, for example a producer, a pipeline operator and a downstream operator, each run their own metering and control environment. At each site, an OPC server in the process control network (PCN) collects metering data from the DCS (distributed control system) and flow computers. Each party needs the others' metering data to reconcile volumes and nominations at the custody transfer points.

Direct communication between the process control networks is prohibited. Instead, each site follows the same layered architecture:

1. The OPC server in the PCN is reachable only from the site's own DMZ, never from another organization. A server-to-server secure transfer moves the agreed data points from the PCN to the site's DMZ.
2. In the DMZ, a server-to-server secure transfer, built on an OPCNet Broker® tunnel and OPC Data Transfer, sends the agreed metering data over the inter-organization link to the OPC server in each partner's DMZ. Data is buffered during a temporary link outage and delivered when the connection returns.
3. The enterprise applications at each site, for example the MOM (manufacturing operations management) application used for reconciliation and reporting, read the data from their own DMZ, not from the partners' control networks.

Only the agreed data points leave each site, and each organization keeps full control of its own firewalls and network zones.

To see a similar architecture in production, read the success story Exchanging Control System Data Securely.