How XoT works
A Lock in front of the equipment and a key for the right person
XoT has four parts. The Lock protects the equipment. The Key shows who the user is. XoT Bridge relays the traffic. In XMS you decide who may connect to what.
The parts
The four parts of XoT
XoT Lock, the Lock
You install the Lock next to the equipment it protects. It lets through only traffic from someone with a valid key. The Lock is available as the XoT-S1 hardware, as a virtual machine and as software.
XoT Key, the Key
The Key is the user's digital identity. It can be a program on a computer, a login in the web browser or a physical key. A machine can also have a key of its own.
XoT Bridge
XoT Bridge relays the traffic between the user and the Lock. So no inbound ports need to be opened in the firewall.
XMS
XMS, the XoT Management Server, is where you create access rules. There you decide who may connect, to what, from where and when.
Step by step
How a connection works
- You create an access rule in XMS. The rule states who may connect, to which equipment, from where and when. Without a rule there is no access.
- The user connects with their key. The traffic goes through XoT Bridge.
- The user and the Lock check each other before any traffic is let through.
- The Lock lets through only the traffic that the rule allows. It stops all other traffic.
- The check is repeated twice a minute while the connection is open.
- When the time in the rule is up, the access ends automatically.
Where the protection sits
The Lock also protects against traffic from inside
A firewall between the network and the internet stops traffic coming from outside. But it does not see traffic between computers on the same network. So if an attacker takes over a computer on the network, they can reach other equipment there.
The Lock sits directly in front of the equipment. So it protects against traffic from both outside and inside.
Firewall
It protects against traffic from outside. It does not see traffic between computers on the same network.
Divided network
The computers are placed in groups that are protected from each other. Dividing the network often requires rebuilding it and stopping operations.
XoT
The Lock protects the equipment it sits in front of. You do not need to rebuild the network.
The equipment
The equipment works as usual
You install nothing on the equipment you protect. That matters for certified equipment and for equipment that can no longer be updated.
The equipment stays unchanged
The protection is in the Lock. The equipment and its settings stay as they are.
The address stays the same
The equipment keeps its address and its place on the network.
The network stays unchanged
You do not need to change the network, the firewall or how traffic is routed.
Common questions
Is XoT a firewall?
No. A firewall lets traffic through according to rules about addresses and ports. The Lock lets through only traffic from someone with a valid certificate. It stops everything else without responding.
Is XoT a VPN?
No. XoT encrypts the traffic with WireGuard, which is a VPN technology. But a VPN connects a user to a whole network. XoT connects a user to specific equipment.
Where can XoT run?
XoT can run in the cloud, in your own data centre or as a mix of both. It can also run completely separated from the internet.
Does XoT work over the mobile network?
Yes. XoT works over any IP network. That includes mobile networks and connections between several sites or organisations.
See how XoT works at your site
One machine and one Lock are enough to get started.