π Case Study
Blasting Control System Zero Trust Pilot β Limestone Mine, Indiana
Single-factor authentication for blast engineers; no session timeout or command replay protection
ποΈ Project Overview
Replacement of legacy wired blasting network with IP-based, cloud-coordinated initiation system
π― Challenge
Single-factor authentication for blast engineers; no session timeout or command replay protection
π§ Design Approach
FIDO2 hardware tokens + short-lived JWTs signed by on-site PKI; command signing with HMAC-SHA384 and sequence-number enforcement
π Design Diagram
AI-generated project design illustration
π Key Calculations
Command Replay Window
Allowed time delta between identical command hashes
Result: β€2.5 sec
Thwarts man-in-the-middle retransmission attacks
JWT Expiry Duration
Session lifetime before refresh
Result: 90 sec
Limits exposure window for token compromise
π Results
100% reduction in unauthorized initiation attempts; passed MSHA Part 46 cybersecurity audit with zero findingsπ‘ Lessons Learned
- β’Blast command signing must include geospatial context (GPS hash) to prevent cross-site replay
- β’On-premise PKI is essentialβcloud CA introduces unacceptable latency and dependency
β Key Takeaways
- 1Blast command signing must include geospatial context (GPS hash) to prevent cross-site replay
- 2On-premise PKI is essentialβcloud CA introduces unacceptable latency and dependency