Why this environment matters
A maintenance jump host sits where outside support personnel acquire access to operating equipment. Its value is in narrowing that access to a specific asset and task, while leaving an accountable record. This concept replaces a broadly trusted remote desktop with a brokered maintenance session whose permissions can end independently of the connection.
The security challenge
A support request would name the engineer, target asset, intended activity and authorised period. The proposed broker would issue the minimum capability needed for that activity, with separate treatment for viewing diagnostics, transferring a file and changing configuration. An authenticated vendor connection would not receive a route to every asset in the plant.
How the capsule model could help
NØNOS capsules could contain the remote-protocol client and the vendor tool, where compatible. A dedicated adapter would provide the approved path to equipment. File transfers would enter a review area rather than becoming immediately executable inside the operational network. Necessary session credentials would not be reusable outside the task. A network interruption can leave a background process or a device session active. The evaluation should establish what happens when the approval period expires, the work order is cancelled or the operator ends the session. Revocation needs to reach the relevant adapter and any delegated authority, not just close the visible window. Session evidence should remain available in a separately protected store. Rebuilding a temporary jump environment can reduce residue, but deleting its memory without recording the required activity would weaken operational accountability. Emergency maintenance also needs a documented exception path that does not quietly become permanent access.
Deployment requirements
Existing vendor tools may require unsupported operating-system interfaces. A practical pilot should start with one supported tool and target. Plant interlocks, change approval and monitoring remain necessary even when session isolation works as intended. Evaluation requirements: Cancel an active work order and confirm that background operations lose their target access. Attempt a connection to a neighbouring asset from the approved tool and verify denial. Interrupt the remote display while recording continues, then reconcile the session history and actual equipment connection state.
Current public-beta limitations, hardware support and application availability must be assessed before any pilot. Neither this use case nor an industry source establishes NONOS certification or a current customer deployment.
Bind the session to the approved work order
A support request would name the engineer, target asset, intended activity and authorised period. The proposed broker would issue the minimum capability needed for that activity, with separate treatment for viewing diagnostics, transferring a file and changing configuration. An authenticated vendor connection would not receive a route to every asset in the plant.
NØNOS capsules could contain the remote-protocol client and the vendor tool, where compatible. A dedicated adapter would provide the approved path to equipment. File transfers would enter a review area rather than becoming immediately executable inside the operational network. Necessary session credentials would not be reusable outside the task.
Disconnecting a screen is not the same as revoking access
A network interruption can leave a background process or a device session active. The evaluation should establish what happens when the approval period expires, the work order is cancelled or the operator ends the session. Revocation needs to reach the relevant adapter and any delegated authority, not just close the visible window.
Session evidence should remain available in a separately protected store. Rebuilding a temporary jump environment can reduce residue, but deleting its memory without recording the required activity would weaken operational accountability. Emergency maintenance also needs a documented exception path that does not quietly become permanent access.
Who could buy or integrate it?
- Industrial asset owners purchasing remote-maintenance infrastructure
- Automation vendors operating equipment support services
- Managed industrial service providers deploying customer access gateways
Industry examples: Rockwell Automation, Honeywell. These are research prospects, not represented as NONOS customers, partners or endorsers.