As buildings get smarter and more connected, the operational technology (OT) that keeps them running—controllers, sensors, meters, and the building automation networks that tie them together—has never been more exposed. Sensors and devices now speak TCP/IP across hybrid IT/OT networks, the old air-gapped boundary is gone, and facility managers, engineers, and system integrators are being asked to secure critical infrastructure that was never designed with today’s cyber threats in mind.
Johnson Controls OpenBlue Airwall was purpose-built to close that gap. It’s a zero-trust security platform built on the Host Identity Protocol (HIP)—an open IETF standard—that creates private overlay networks from encrypted tunnels and trusted cryptographic identities. In plain terms, it makes your critical assets invisible to anyone who isn’t explicitly trusted, while still letting the right people and systems connect securely from anywhere.
Built for Zero-Trust Connectivity
Traditional network security trusts a device because of where it sits—its IP address or its place inside a firewall. Airwall flips that model. Every device is given a verified cryptographic identity, and policy is enforced against that identity before any connection is allowed. Because identity isn’t tied to location, policy follows the asset: when a device moves, its protection moves with it.
All traffic runs through encrypted HIP tunnels over private overlay networks that sit on top of your existing infrastructure—any IP network, shared, public, or even compromised. There’s no rip-and-replace: Airwall layers over what you already have, adds multi-factor authentication and micro-segmentation, and gives you a single pane of glass to author and enforce policy everywhere.
Security You Can Measure
The value shows up where it matters—less exposure and lower cost. OpenBlue Airwall reduces the attack surface by up to 95% while cutting cost and complexity by 50–80% compared with traditional approaches. And because faults and intrusions are isolated inside micro-segments, incidents are contained and recovered faster instead of spreading across the network.
Key Features at a Glance
- Identity-based zero trust — Access is granted to verified cryptographic identities—not IP addresses—with multi-factor authentication built in.
- Invisible by default — Protected assets don’t respond to unauthorized devices, dramatically shrinking the attack surface.
- Micro-segmentation — End-to-end encryption isolates systems so a breach in one area can’t move laterally.
- Policy that follows the asset — Identity isn’t tied to location—when a device moves, its policy moves with it.
- Single pane of glass — Author, deploy, and enforce security policy across IT, OT, IoT, and cloud from one console.
- Works over any network — Runs on existing infrastructure—shared, public, or compromised—with no equipment replacement.
- Network visibility & threat detection — Correlates traffic and integrates with third-party detection tools for faster response.
Five Building Blocks, One Platform
Airwall is deployed from a small set of components that work together to make assets invisible and connections trusted:
Proven Across Critical Infrastructure
Airwall is already protecting demanding, real-world environments—the kind of distributed, safety-critical systems that can’t afford downtime. Figures below are reported by Johnson Controls:
- Higher education: A major university secured 640+ buildings, achieving roughly a 90% attack-surface reduction and 10× faster deployment.
- Maritime: A cruise line reduced cyber risk by about 90% with no downtime or costly upgrades.
- Utilities: A regional electric cooperative protected 43+ substations and 2,100 miles of transmission lines at reduced cost.
- Healthcare: A healthcare provider enabled secure remote access across hospital networks without disrupting patient care.
Works With What You Already Have
Airwall is designed to fit into live environments rather than replace them. It runs over any IP network without vendor lock-in, extends protection to legacy equipment through the Gateway, and integrates with best-in-class detection—Airwall does integrate with an IDS, providing secure transport from building networks to a single cloud-based sensor. Complementary Airwall solutions cover secure remote access, micro-segmentation, and network visibility, so you can start with the highest-priority use case and expand from there.
Resources
OpenBlue Airwall product page (Johnson Controls)
OpenBlue Airwall Brochure (PDF)
Ready to Learn More?
OpenBlue Airwall delivers identity-based zero-trust security, a dramatically smaller attack surface, secure remote access, and simplified OT protection—all layered over the network you already run, and proven across universities, utilities, healthcare, and maritime operations.
Contact your Canada Controls sales representative today to assess your building automation and OT networks, scope an Airwall deployment for your sites, or request a demo.
