I need a Secured acces to shared variables and network stream on a cRIO

[~Its_Me~]

Hello all,

I have got a cRIO connected to the network.

The cRIO:

• Runs a shared variable server and,
• Uses a network stream for command handeling.

There is a GUI pc connected to the same network to control the cRIO

What I would like to achieve

Everything works fine, however I would like to make the testsystem more secure.

One of the reason for this is:

• I want one GUI, lets name it the Master-GUI, to be able to control and monitor the cRIO.
• Another GUI-Slave may only monitor the progress of the test and may not be able to control the cRIO.
• Later on I would like ( if possible) 2 Master-GUI's A and B. Master-GUI-A may only be able to control test A and Master-GUI-B may only control test part B. A and B need to use the same cRIO.

I really want to block all other non authorized acces to the cRIO. 

I did try to find information how I could achieve this. Yes I did find a lot of info telling to use a VPN or use of a separate network etc. But I can never achieve this because big company's can be bureaucratic and the place where I work is no exception.  

Info I did check

This link describes I could use the variable manger, but I can not find this option in my Labview version (2018) "Just use Tools>Shared Variables>Variable Manager. With Edit>Security you can grant access to computers or deny it."

https://forums.ni.com/t5/LabVIEW/Protect-acess-to-shared-variable-network/td-p/615257

This link might describe it can be done but leaves me in the dark about how to achieve my goals, it only tells what to install and not what to do with it:

https://knowledge.ni.com/KnowledgeArticleDetails?id=kA00Z000000g2kUSAQ&l=nl-NL

etc

Can someone please tell me how to achieve my goals? 

Thank you all for the help!

[Bob_Schor]

The "easiest" way to accomplish part of your goal, it seems to me, is to use "isolated networks".  I've written some LabVIEW Real-Time routines that use a cRIO or PXI system as a Target, with Development taking place on a PC with two NICs.  One goes to the "corporate Network" and provides Internet access.  The other is assigned to a "non-routable IP subnet" (such as 10.x.x.x) and goes to an inexpensive 5-port switch, into which I plug the Target.  I've never tried, however, to simultaneously "talk to" two Remote Targets ...

Bob Schor

[~Its_Me~]

Hello Bob thank you for the reply,

I understand what you are telling me. And it would be a good solution for some setups but I am afraid this setup is different.  I did make a picture to clarify the testsetup I need to adapt. Before I explain more details I need to point out I am not happy with one cRIO controlling two machines. I do not know why the setup was designed this way, the person responsible has left the company a long time ago. Yes I rather change it but as I wrote it's kind of bureaucratic where I work, changing the hardware might take ages!

Below I added a picture of the testsetup

At this time 'GUI A Controll pc'  is used for both test machines.  The 'GUI monitor PC'  and the 'GUI B Controll pc'  are not implemented yet, these two need to be added. 

The code used now was based on the example: "LabvVIEW FPGA Control on CompactRIO". For this question the important parts are the:

• Network shared variables, which are used to monitor some measured values and,
• The command stream. 

Network shared variables

The Network shared variables are only read, at the side of the GUI. The cRIO reads and writes this data, and hosts the variable server. I did try to find a way to make the network shared variable read/write for all code on the cRIO. While blocking other devices write acces, such as the GUI Monitor PC's on the network. I could not find a way to achieve this. If it can be done can someone please explain how I could do this?  I can see a acces type defined at the properties of the network-published variable but it is greyed out:

The command stream

The command stream can send commands and settings such from the GUI to the cRIO. According to the help files I could make more command streams with a different name, I have not tried yet if I can connect 2 PC's to one cRIO. However if it works, I still would like some "protection key" or other method  ensuring some level of protection, making sure controll PC A and B  can controll the cRIO and PC x without the key can not controll the cRIO.

Using 2 NIC's

I Think If I use a PC with 2 NIC's I can maybe connect GUI - A Controll and GUI - B Controll to a switch. The downside would be I can not use a monitor PC anymore. And I need to check if I get a bureaucratic reaction from the IT department. 

Thank you for the help!