GridShield security and architecture

Design goal

A compliance tool that connects to protection and control systems must never become a risk to them. GridShield is designed to observe and record, never to control, and to run entirely inside the customer's network.

Three tiers

• Command Center — the central application: asset inventory, Evidence Vault, RSAW worksheets, alerts and change workflows. Installs from a bootable ISO as a hardened Linux appliance; runs on-premises or air-gapped. Single instance today.
• Node — a site collector written in Go. It connects to the Command Center over a mutually authenticated TLS (mTLS) gRPC stream and caches locally if the link drops, syncing when it returns.
• Agent — optional, for Windows and Linux hosts: file-integrity monitoring and host evidence, reported to its Node.

Read-only by design

• Modbus TCP: read functions only (FC3/FC4); write function codes 5, 6, 15 and 16 are blocked.
• DNP3: read-only polling (FC1); select/operate is blocked.
• Passive collection from SPAN/mirror ports never transmits onto the monitored network.
• Network and host collection uses SSH, WinRM over HTTPS, SNMP v2c/v3, NETCONF and vendor REST APIs with read access.

Identity and transport

• A private certificate authority in the Command Center issues the certificates Nodes and Agents use; every Node–Command Center connection is mutually authenticated.
• Windows collection uses WinRM over HTTPS with CA-pinned TLS.

Updates you can verify

Command Center, Node and Agent updates are delivered as offline packages signed with Ed25519 and verified before they are applied — suitable for air-gapped sites where updates arrive on approved media.

Evidence integrity

Every evidence record is SHA-256 hash-chained per asset. The Evidence Vault verifies the chain and exports to CSV, so any alteration of a stored record is detectable.

What GridShield does not do

• It does not issue control commands to field devices.
• It does not require a connection to the internet or to GridSafe; vulnerability data can be loaded from signed offline bundles.
• It does not implement IEC 61850 MMS or Modbus RTU today; the supported-device catalog shows what is full, partial and planned.