Biometric-Gated SD-VPN Gateway for Secure Remote PLC (Siemens S7-1200) Control with Microsegmentation and Conversational Monitoring

Resumen

In industrial automation, PLCs such as the Siemens S7-1200 are essential components for process management; however, the need for remote access to these devices introduces vulnerabilities such as unauthorized access. Although VPNs are used to protect the communication channel, their authentication is often limited to password-based access or manually granted permissions. In addition, industrial monitoring systems lack simple and interactive remote query mechanisms, limiting the ability to verify the PLC status, access history, or the user who performed an operation. This study proposes the implementation of a secure remote control system based on a Raspberry Pi 5 acting as a gateway running ZeroTier to establish secure connectivity and microsegmentation to a Siemens S7-1200 PLC. Access is restricted through facial biometric authentication implemented with an anti-spoofing module, MediaPipe, and Teachable Machine. A conversational monitoring workflow developed in n8n is also integrated to query the PLC status via WhatsApp. Validation included 240 biometric attempts (120 authorized and 120 unauthorized), achieving an accuracy of 95.42%, FAR of 0.00%, and FRR of 9.17% under a confidence threshold of 0.95. For PLC control, 50 Put/Get operations were performed, achieving 100% success, with an average end-to-end latency of 192.40 ms (p95 = 238.68 ms). These results show that the proposed architecture enables secure remote PLC access with biometric authentication while maintaining communication performance compatible with industrial environments.