Ghost Pipe — Industrial OT Brief
The problem with OT/IT data transfer is architectural, not operational.
OT networks cannot connect directly to cloud systems. VPNs create persistent attack surfaces. Legacy protocols (FTP, SMB, OPC-DA) are not quantum-safe. Sensor data in transit is being collected now for future decryption — the Harvest Now, Decrypt Later (HNDL) threat. Ghost Pipe is a quantum-safe data conduit designed for the IEC 62443 zone boundary.A RAM-only relay for the DMZ zone boundary. No VPN. No network reconfiguration. No persistent storage. Sensor data enters encrypted, burns after delivery. The relay is a conduit, not a server.
Deployable on a Raspberry Pi 3B+ at the field level, or in your existing DMZ on any Linux server.
Not a SCADA historian. Not a VPN replacement for general traffic. Not a cloud service you depend on — the relay runs in your own infrastructure, under your own keys, and operates without external connectivity if needed.
Architecture & Deployment
On the Ghost Pipe and SDK paths in this brief the relay holds only ciphertext, only in RAM, only until delivered. It has no knowledge of sensor values, device identifiers, or process state. A full relay compromise yields zero plaintext.
/v2/did/registerdocker compose upSends one encrypted packet every 15 seconds. Each burns after the receiver reads it. Interval and TTL configurable.
Signs the firmware binary with ML-DSA-65, distributes to device group. Each device downloads once and the package burns.
Minimum hardware: Raspberry Pi 3B+ · 512 MB RAM · 4 GB SD · Ethernet. No display required. Connects to your DMZ network segment.
IEC 62443 Compliance Matrix
The table below maps IEC 62443-3-3 System Security Requirements to Ghost Pipe protocol properties. Documentation available at paramant.app/docs#compliance-iec62443.
| Requirement | Title | Ghost Pipe implementation | SL-T |
|---|---|---|---|
| SR 4.1 | Information confidentiality | ML-KEM-768 client-side encryption. Relay never holds plaintext on the SDK and Ghost Pipe paths this brief describes. Fixed-padding blobs, so traffic analysis is blind and SCADA message sizes are not leaked. | 2–3 |
| SR 4.2 | Use control | API key per device (pgp_ end-user, plk_ operator). Device identity registration via /v2/did/register. Key revocation supported. Per-key audit trail. |
2–3 |
| SR 3.1 | Communication integrity | ML-DSA-65 (NIST FIPS 204) Signed Tree Head after every Merkle root update. Inclusion proof per transfer — tamper detectable by any party, including independent auditors. | 2–3 |
| SR 2.8 | Auditable events | Public Certificate Transparency log at paramant.app/ct. Append-only, tamper-evident, publicly verifiable. Export to SIEM supported (JSON + CSV). Every transfer hash logged. | 2–3 |
| SR 5.2 | Zone boundary protection | Self-hosted relay deployed in DMZ. No persistent data crosses zone boundaries. No direct L2↔L3 connection required. Relay operates without external internet in air-gap mode. | 2–3 |
| SR 1.1 | Human user identification | Device enrollment via POST /v2/did/register with ECDH public key. DID (Decentralized Identifier) per device. Key rotation and revocation supported. |
2 |
| SR 1.2 | Software process identity | Device identity bound to ML-DSA-65 public key. Every transfer signed by the originating device. Identity not forgeable by the relay. | 2 |
| SR 2.1 | Authorisation enforcement | Per-key transfer quota and rate limiting. Plan-based access control (free / pro / enterprise). Relay rejects keys that exceed plan limits with HTTP 402/429. | 2 |
Note: Compliance documentation maps Ghost Pipe capabilities to IEC 62443 requirements. It is not a third-party certification. Customers seeking SL-T 3 certification should engage a certified IACS assessment body (e.g., TÜV, DNV) for formal verification.
Deployment & Pricing
| Payload | Relay (EU/DE managed) | Self-hosted LAN | Notes |
|---|---|---|---|
| 4 KB sensor packet | p50: ~80ms · p95: ~180ms | <10ms typical | Includes TLS + ML-KEM encapsulation |
| 64 KB config blob | p50: ~140ms · p95: ~320ms | <20ms typical | Single chunk, base64 encoded |
| 1 MB firmware chunk | p50: ~900ms · p95: ~2.1s | <80ms typical | 500 MB per file, in 5 MB blocks |
| 5 MB max blob | p50: ~4.2s · p95: ~9s | <400ms typical | RAM limit per relay: 512 MB |
Benchmarks: EU sender/receiver pair, Hetzner relay in Germany, 100 Mbps uplink. Self-hosted LAN: 1 Gbps local network. Run paramant-benchmark.py to validate in your environment.
iot.paramant.app — Hetzner DE. Free evaluation: 1000 transfers / 30 days, no daily cap. Pro and Enterprise keys available.
No infrastructure required. Start evaluating in minutes.
Any Linux server. systemd unit included. Reverse proxy config for nginx/Caddy provided.
ARM64 native. 512 MB RAM min. Runs headless. Ideal for field-level DMZ segment.
Community self-hosted: BUSL-1.1 free forever, up to 5 users. Your server, your jurisdiction, your keys. No license required for evaluation.