Technology

01

Four steps, on every link

Every link goes through all four, every time. The algorithms are public standards: ML-KEM for keys, ML-DSA for signatures.

1. 1

   Verified identities

   Both sides present a certificate with a signature that resists quantum computers.

   ML-DSA-65

2. 2

   Key exchange

   Fresh keys for every link, derived from two methods together.

   X25519 + ML-KEM-768

3. 3

   Protected channel

   Every message is encrypted with 256-bit keys and checked for tampering.

   TLS 1.3

4. 4

   Permission per service

   The link opens only for the agreed services. The rest stay closed.

   Signed rule

One link at a time, with plants in operation

• Granularity

  Each link has its own identity and permissions, site by site and device by device.

• Reach

  From the control centre to a single device in the field, even on the smallest systems.

• No changes

  Applications and devices stay as they are. Only the agent is added.

The customer chooses which links to protect, and in what order, according to their priorities.

02

Zero Trust on every link, from day one

No device is trusted by default. Every link opens only after mutual recognition, and only for the permitted service. These protections already work against today’s attacks.

On the links

• Threat: Unknown or cloned device

  An identity for every device

  Each device has its own key, generated on the device. A second person approves its admission.

• Threat: Stolen credentials

  Mutual recognition

  Before a single byte is exchanged, both ends of the link recognise each other.

• Threat: Intruder moving from system to system

  One permission per service

  Each device reaches only the services written in its rule. Everything else stays closed.

• Threat: Interception and altered commands

  Sealed messages

  Every message travels encrypted with 256-bit keys. If someone alters or replays it, it is discarded.

• Threat: Failure forced to fall back to plain text

  Protection or nothing

  If protection is unavailable, the link stops. Nothing passes in clear.

• Threat: Lost device or departed supplier

  Exclusion with one command

  An excluded device is rejected and its open sessions close at once.

For operators, software and audit trails

The management centre sets the rules but never sees the data. Exclusions take two people. Every event leaves a signed trace, which also helps reconstruct an incident.

• Threat: Insider abuse

  Four-eyes decisions

  Excluding or readmitting a device takes two people, each with their own signature.

• Threat: Forgotten access

  Permissions that expire

  Rules, credentials and sessions expire on their own. Whoever still needs them renews them.

• Threat: Management centre attacked or down

  The centre decides, but cannot see

  The centre writes the rules and cannot read the data. If it stops, the links stay protected.

• Threat: Traces erased after an intrusion

  A signed trace of every event

  Who talked to whom and when, and what was rejected, stays on record in a verifiable form.

• Threat: Software flaws

  Code in a memory-safe language

  The code is written in Rust, which by design avoids the memory errors attackers exploit most.

• Threat: Fake update

  Verified updates

  A fake update is rejected. A faulty one rolls back on its own.

04

One management centre for identities, permissions and exclusions

The management centre shows which devices communicate and with which permissions, site by site. Exclusions take two people.

Signed updates, on the customer’s schedule

Updates arrive signed and are verified before activation. If the start-up test fails, the system returns to the previous, already verified version.

1. 1Crystallis signs the package
2. 2The customer receives it
3. 3Verifies the signature
4. 4Activates it when they decide
5. 5If the test fails, it rolls back

05

Developed and controlled in Europe

Development and the team are in Europe, and the code and know-how belong to Crystallis. Data and keys stay under the customer’s control.

• Developed in Europe

  The team and research are based in Europe.

• Own code and know-how

  Developed by our own team and owned by Crystallis.

• No foreign cloud

  There is no foreign cloud anywhere in the data path.

• Keys on the customer’s systems

  Keys never leave the devices.

• Verifiable software

  Reproducible builds, with libraries included.

• Management centre under control

  No non-EU entity in the management centre.

Agents, the management centre and keys sit on the customer’s systems, with no external dependencies. Crystallis delivers signed software and support.