Skip to main content

​
The Problem

Industrial and IoT environments generate vast amounts of operational data - sensor readings, PLC outputs, SCADA events, energy measurements, environmental conditions. This data drives automated decisions, feeds regulatory reporting, and provides the evidence base for operational accountability. The problem is that most OT data pipelines were designed for availability and performance, not for integrity. Data travels from sensor to historian to reporting system through a chain that is mutable at every stage - values can be corrected, smoothed, or overwritten without trace. When a dispute arises - over a regulatory measurement, an insurance claim, a contractual obligation, or an incident investigation - the data in the historian is what the system says it is. There is no way to prove it hasn’t been altered. For critical infrastructure operators facing NIS2 obligations, this is increasingly a compliance gap, not just a technical inconvenience.

​
How ROOTKey Solves It

ROOTKey anchors sensor readings and OT events at the point of generation - before they enter any mutable storage or processing pipeline. Anchoring happens over MQTT, the native protocol of most IoT and industrial environments, which means:
  • No changes to device firmware - devices publish to their existing MQTT topics
  • No HTTP stack required - devices that cannot run REST clients can still participate
  • No latency impact - anchoring is asynchronous; device operation is unaffected
  • No OT network redesign - MQTT bridging keeps anchor traffic contained within defined network boundaries
The result is a stream of tamper-evident data points, each with a blockchain-anchored cryptographic proof, that can be verified by regulators, auditors, or counterparties independently.

​
Architecture

The MQTT bridge subscribes to device topics and forwards payloads through ROOTKey’s integrity pipeline. Devices are unaware of ROOTKey - they continue to publish as they always have.

​
Implementation

1

Configure the MQTT bridge

Deploy the ROOTKey MQTT bridge at the boundary between your OT and IT networks, or within the OT zone if network policy allows. Configure the bridge with your broker address, credentials, and the topic patterns to monitor.→ MQTT Deployment Guide · Contact [email protected] for bridge configuration documentation.
2

Create vaults per device class or data category

Organise vaults by device type, measurement category, or regulatory obligation. This enables granular access control and allows you to provide regulators with scoped evidence for specific systems.→ Create Vault
3

Map MQTT topics to vault and asset identifiers

Configure the bridge to map each MQTT topic to a specific vault and logical asset. Each topic becomes a traceable data stream with its own integrity history.→ MQTT Deployment Guide
4

Validate readings on demand

At any point - during a regulatory inspection, an incident investigation, or a routine audit - retrieve the on-chain anchor for any reading and validate it against the archived value.→ Validate File · Get File History
5

Monitor anchoring coverage with Analytics

Use the Analytics API to verify that anchoring is continuous and complete - detect gaps that might indicate device downtime, network issues, or tampering with the bridge.→ Analytics - Vault Creation Over Time · Analytics - Files vs Validations

​
Key API Endpoints and Resources

​
Compliance Alignment

Request an OT integration consultation

Our team will assess your OT network topology, MQTT infrastructure, and data classification requirements - and design a bridge architecture that fits without disruption.

Get started with the API

Create a sandbox vault and simulate sensor data anchoring before touching your production OT environment.