Trust Boundaries
Status: DRAFT
TB-1: Customer LAN / Internet -> Gateway
The customer network is untrusted.
Controls:
- outbound-only application connectivity where possible
- VPN
- no unnecessary inbound services
- host firewall
TB-2: Gateway -> EMS Backend
Controls:
- NATS JWT identity
- per-device authorization
- encrypted transport
- VPN network policy
TODO: verify whether every device has a unique NATS signing identity and unique VPN key/certificate.
TB-3: Gateway -> Inverter
RS485 / Modbus RTU has no native authentication or encryption.
Controls must therefore be provided by the gateway:
- no direct remote access to RS485
- semantic command allowlist
- register allowlist
- value-range validation
- inverter-model validation
TB-4: Physical access -> Gateway
Threats include:
- microSD removal
- credential extraction
- storage cloning
- serial console access
- physical reset/reprovisioning
Controls: TODO.