The 'Visunet RM Shell' firmware was first introduced in 2007; the sixth generation is now being launched. It supports users in the integration of thin clients into modern process control systems and automation infrastructures. The optimized user interface, which guides automation engineers and administrators through the essential setup steps, is particularly helpful in this regard, thus reducing IT complexity to a minimum. Once set up, the thin client can be operated in kiosk mode: The thin client therefore establishes the defined remote desktop connections - such as Microsoft RDP or VNC - to the host computer (for example from the process control system) and monitors them. This ensures that the thin client automatically re-establishes the connections even in the event of a fault - for example, after a power failure or a restart of the host server following a security update.

The 'intelligence' is in the firmware itself; the thin clients become 'smart' on their own. In contrast to other thin client solutions, there is therefore no need for an additional central management server, which is reflected in significantly lower hardware costs and management effort.

Tailored to process automation

A major change in Visunet RM Shell 6 is the completely redesigned user interface and menu navigation, which includes a revised home screen, integrated help texts and dark mode. Thanks to the Smart Task Bar, more complex application scenarios, such as switching between multiple connections (e.g. between process control system and manufacturing execution system), are also better supported. The Smart Task Bar allows users direct access to various system functions with just one click. This allows connections to be switched more efficiently and, for example, the on-screen keyboard can be called up and hidden depending on the situation. This means that relevant screen content - such as process control screens - is not covered by the on-screen keyboard, giving users a better overview.

End-to-end security

In addition to usability optimization, the development of the current firmware version focused on security. The principle of 'security by design' was applied here. In accordance with the internationally standardized security development process standard IEC 62443-4-1, security-relevant aspects were taken into account right from the start of development. This includes a complete security context analysis and definition as well as a threat analysis based on this.

The results of the threat analysis were then incorporated into the design as requirements and taken into account in the architecture of the firmware. One of the resulting core measures is that the user rights and user authentication in the firmware were implemented more finely granularly at Windows user level. Visunet RM Shell 6 follows the basic security principle of 'Least Privilege', according to which users only have the minimum necessary rights. Since the 'Operator' is executed with reduced system rights, even if the system is compromised by malware, it can also only act with limited rights, which protects the system settings from being changed, for example.

While these software innovations have an effect 'under the surface' and are barely noticeable for standard users, they offer new possibilities for managing thin clients: 'Hybrid Management Mode' also allows experienced administrators to access the Windows desktop. In addition to the easy addition of additional drivers and tools, this also enables simple integration into a Microsoft Active Directory and the use of familiar Windows management tools, for example to install Windows security patches or implement single sign-on (SSO) scenarios.

In addition to these innovations, the firmware implements additional basic protection measures that support the resilience of the overall system against malware and attacks. These include the Unified Write Filter (UWF), the firewall and protection against access to USB storage media. In addition to the conventional Windows Defender virus scanner, third-party virus scanners such as Trellix Endpoint Security can also be used.

Central administration

The author: Dr. Marc Seißler is Head of Product Management HMI at Pepperl+Fuchs in Mannheim.

© Pepperl+Fuchs

In addition to the current firmware generation, there is also a new version of the optional thin client management tool 'Visunet Control Center'. This enables the central management of all RM Shell-based thin client devices, from industrial box thin clients (BTCs), which are used in control rooms and production-related workstations, to mobile industrial thin client tablets and remote monitors in hazardous areas. All devices can be set up, configured and monitored from a central workstation via the network using the Visunet Control Center, which means that time-consuming walking and driving to individual devices is no longer necessary. With the help of wizards, settings can be configured, transferred and saved simultaneously on any number of target devices within the network. Firmware updates can also be carried out simultaneously on all devices with a single click.