0DATAYIELD · Network technical sheet

Unidirectional push — what goes out, what never comes in

Document for the CISO / CIO · v1.0 · to attach to the security validation file

Principle

The 0DATA box is a read-only device connected to the production meter or inverter output (current clamp, pulse output or read-only Modbus — mechanism detailed in Appendix C). It only initiates outbound connections to the 0DATA collector. No inbound port is open, no VPN, no remote takeover, no access to the site's information system.

What LEAVES the site (and nothing else)

Chained SHA-256 hashes, never the raw data.
Ed25519-signed aggregated measurements (value + timestamp), in JSON format.
Protocol: HTTPS / TLS 1.3, outbound port 443 only.
100% LAN-isolated alternative: integrated 4G SIM card (no network contact with the information system).

What NEVER comes in

No inbound connection (firewall: all inbound traffic to the box is denied).
No access to equipment, write access to SCADA, or to the information system.
No personal data, no detailed raw production data.
The signing private key is generated on the Box at installation and never leaves it.

Network requirements (minimum)

Need	Detail
Allowed outbound	`443/TCP` to the collector FQDN (provided). No other port required.
Inbound	None. The Box listens on no accessible port.
Isolation	The Box can be placed on a dedicated VLAN or on its 4G SIM — no access to other segments.
Power	On site, DIN rail in the electrical cabinet. ~15 W, fanless.
Certificates	Site-specific Ed25519 key, generated on the Box at installation (never in the workshop); it never leaves the Box. Secure element on rev. B.
Updates	Firmware updated by on-site visit (no inbound OTA channel) — frequency and cost detailed in Appendix C.
Time-stamping	GPS time source (independent of the network); failing that, time aligned with the collector's TLS responses (no additional port). Any clock drift is detected and recorded.

Threat model (what happens if the Box is compromised)

The Box contains no exploitable historical raw data — only hashes and its own signing key.
It cannot pivot to the information system: no inbound network path, no embedded information-system credentials.
It cannot rewrite an already-published anchor on the public ledger — prior history remains intact and verifiable.
Compromise is detectable by cadence break or multi-source cross-check (Settlement tier) — not by signature anomaly if the key has been extracted (the attacker's signatures are then valid).

Scenario not covered (transparency)

Extraction of the signing key (no secure element on rev. A): an attacker holding the key can forge valid logs until detection by cadence break or multi-source cross-check (Settlement tier). Mitigations: key generation on the Box at installation (never in the workshop), secure element on rev. B, key rotation with re-attestation. We prefer to state this limitation rather than let you discover it.

Compliance

Architecture designed to facilitate the Client's NIS2 and DORA compliance — segmentation and minimization: no inbound access, minimal data (hashes), verifiable audit log, full reversibility (complete log export at any time).

0DATA SARL · RCS Rennes 899 851 315 · support@0data.fr · Technical document v1.0 — detailed diagram and firewall rules provided on request for the security review. See also: 0data.fr/securite.html