IT/OT Separation: Two Domains, One Boundary
Business IT and operational technology are physically and logically distinct domains; the only bridge between them is a governed, mostly one-way boundary.
Two worlds with different failure modes
Information Technology (IT) carries email, engineering documents, model training clusters, and the L7 external API. Operational Technology (OT) runs the machine: magnet power supplies, gyrotron/NBI heating, gas valves, cryoplant, the L1 fast control loop, and the safety-instrumented systems. Their threat profiles diverge. IT tolerates a reboot; an OT node that stalls mid-discharge can leave a 9.66 MA plasma unactuated. IT prizes confidentiality; OT prizes availability and integrity of control. Mixing them lets an IT compromise (phishing, ransomware) reach machine actuators. We keep them apart.
The separation model
- Distinct physical networks with no shared switches or routers between IT and OT.
- No general routing between domains; the only crossing is the plant boundary appliance.
- OT holds no direct internet egress; updates and telemetry cross the boundary under policy.
- Directory, DNS, and time services are duplicated per domain so OT does not depend on IT infrastructure to keep the machine safe.
Data flows across the boundary
The dominant flow is OT-to-IT telemetry: plasma diagnostics, digital-twin state, and audit records leaving the machine for analysis. That flow crosses a unidirectional data diode so a compromised IT side cannot inject into OT. The rare reverse flow (a validated model update, a new control policy) uses a separate, tightly gated path with two-person authorization; see air gaps and controlled bridging.
Relation to the Purdue reference
The split is aligned to the Purdue segmentation model: enterprise levels (4/5) live in IT, control levels (0-3) in OT, and the boundary sits at the level 3.5 industrial demilitarized zone. Kronos hardens that DMZ into a diode-plus-broker pair rather than a conventional firewall pair.
Design status: the logical separation and boundary policy are implemented in the twin environment. The physical two-network build, diode hardware, and duplicated OT infrastructure are specified for the FOAK plant from Q2 2027 and not yet deployed on operating hardware.