trex Cloud
Login

Security

An Overview of trex Cloud’s Security Features

Security Overview

trex Cloud is built with security as a foundational principle. It provides a modern and scalable security model that protects data in transit, controls access at the application level, and supports enterprise-grade authorization practices across users, services, and integrations.

This document provides an overview of the core security mechanisms used in trex Cloud, including secure API access, Role Based Access Control (RBAC), and secure machine-to-cloud streaming.

1. Secure REST API Access (OAuth 2.0)

trex Cloud offers secure access to its REST APIs using industry best practices and standardized authentication and authorization methods based on OAuth 2.0.

OAuth 2.0 enables trex Cloud to support secure and flexible access patterns for different integration needs such as:

  • User-based access via web and mobile applications
  • Service-to-service integrations
  • External partner applications
  • Automation and scheduled workloads

1.1 Token-Based Authentication

Instead of sending usernames and passwords with each request, OAuth 2.0 uses access tokens. Clients obtain an access token from the authorization server and use it to access trex Cloud APIs.

Key benefits:

  • Credentials are not repeatedly transmitted over the network
  • Access tokens can be short-lived and rotated safely
  • Tokens can be revoked if needed
  • Authorization can be enforced consistently at the API gateway level

1.2 Fine-Grained Authorization

OAuth 2.0 enables controlled access to API resources by supporting:

  • Scoped access (granting only required permissions)
  • Application-level access separation (different apps may have different privileges)
  • Auditable authorization flows suitable for enterprise environments

This ensures integrations are not over-privileged and follow the principle of least privilege.

1.3 Secure Integration Patterns

trex Cloud can support secure integration flows such as:

  • Authorization Code Flow for interactive applications
  • Client Credentials Flow for server-to-server integrations
  • Controlled token lifetimes for better security posture

This design allows customers to integrate trex Cloud into their IT ecosystem while meeting corporate security standards.

2. Role Based Access Control (RBAC)

trex Cloud implements Role Based Access Control (RBAC) to ensure users and services can only access the data and functionality they are authorized to use.

RBAC is a critical capability for enterprise deployments because it allows organizations to manage permissions in a structured, scalable, and maintainable way.

2.1 What RBAC Provides

RBAC enables trex Cloud to:

  • Restrict access to features, screens, and API endpoints
  • Control access to sensitive operational and production data
  • Prevent unauthorized changes to system configurations
  • Separate responsibilities across teams and departments

2.2 Role-Based Permission Enforcement

Permissions are enforced based on roles rather than manually assigning permissions to every individual user.

This approach supports:

  • Centralized security management
  • Consistent authorization behavior across the platform
  • Easier onboarding and offboarding of employees
  • Reduced risk of accidental over-permissioning

2.3 Typical Role Scenarios

RBAC can be used to define different access levels such as:

  • Operators: view production status and assigned tasks
  • Production Engineers: analyze performance, configure thresholds, review alarms
  • Maintenance Teams: access machine health and fault history
  • Quality Teams: access inspection data and defect records
  • Executives / Managers: view dashboards and KPI-level insights
  • System Administrators: manage users, roles, integrations, and policies

This ensures that each stakeholder interacts with trex Cloud only within the boundaries of their responsibilities.

3. Secure Machine-to-Cloud Streaming (Asymmetric Encryption + HMAC)

Streaming data from machines and industrial environments to trex Cloud is protected using asymmetric encryption and HMAC (Hash-based Message Authentication Code).

This ensures that industrial telemetry, machine signals, and production events remain secure during transmission.

3.1 Why Machine-to-Cloud Security Matters

Industrial environments often involve:

  • Sensitive operational data
  • Safety-critical processes
  • Production performance information
  • Proprietary machine parameters

If machine data is not properly secured, it may lead to risks such as:

  • Unauthorized data interception
  • Data tampering during transmission
  • Fake telemetry injection
  • Loss of trust in monitoring and analytics results

trex Cloud addresses these risks by applying strong cryptographic controls.

3.2 Asymmetric Encryption (Confidentiality)

Asymmetric encryption ensures that data transmitted from machines to trex Cloud cannot be read by unauthorized parties.

Key characteristics:

  • Uses a public/private key mechanism
  • Data encrypted with the public key can only be decrypted by the private key
  • Prevents passive interception from revealing sensitive content

This provides confidentiality, meaning the data remains private even if traffic is captured.

3.3 HMAC (Integrity + Authenticity)

HMAC provides:

  • Integrity: ensures the message has not been modified in transit
  • Authenticity: ensures the message was produced by a trusted sender with the correct secret

With HMAC:

  • Each message includes a cryptographic signature
  • The receiver verifies the signature before accepting the data
  • Any modification to the payload invalidates the signature

This protects trex Cloud against:

  • Tampering attempts
  • Replay-like payload modifications
  • Malicious data injection into telemetry pipelines

3.4 Combined Security Outcome

By combining asymmetric encryption and HMAC, trex Cloud achieves:

  • Confidentiality (data cannot be read by attackers)
  • Integrity (data cannot be altered without detection)
  • Authenticity (data origin can be validated)

This provides a robust foundation for secure, scalable industrial data streaming.

Summary

trex Cloud provides a strong security architecture across API access and industrial data streaming:

  • Secure REST API access using OAuth 2.0
  • Controlled authorization through Role Based Access Control (RBAC)
  • Secure machine-to-cloud streaming using asymmetric encryption + HMAC

This approach ensures trex Cloud can operate in enterprise environments where security, compliance, and operational trust are critical requirements.