Introduction: From the Design Bench to the Coating Machine—How Far Does Data Travel?
A high-end telecentric lens for industrial inspection goes through the following journey from concept to mass production:
An optical designer completes the initial structure in Zemax, and the generated optical drawings are delivered to a structural engineer for mechanical packaging design. After the structural engineer completes the 3D modeling of the lens barrel in SolidWorks, the drawings flow to the process department to formulate a machining plan. The process department passes coating parameters and grinding precision requirements to the precision machining workshop. The workshop feeds MTF inspection data of trial samples back to the design team for iterative optimization. Finally, the finalized optical system drawings and process parameters are archived, and some materials are sent to external coating suppliers and precision machining partners.
Along this path, data flows repeatedly among optical design workstations, structural design endpoints, process endpoints, and workshop industrial control computers. Every transfer is authorized, and every node complies with permission configurations—but if the data itself does not carry security attributes, the security of the entire chain can only depend on the self-discipline of each operator.
This is precisely the most fundamental dilemma in endpoint security management for the electro-optical industry.
Part One: Three Types of Endpoints, Three Sets of Management Logic
The endpoint environment of an electro-optical enterprise is naturally split into three completely different worlds.
1. Optical design workstations are the soul of the enterprise. These endpoints run professional optical design software such as Zemax, CodeV, LightTools, and FRED, which consume enormous system resources and have extremely high compatibility requirements for encryption drivers. An optical designer may spend weeks optimizing a set of lens parameters. If the encryption solution causes design software lag or file corruption, the loss is not just time, but design inspiration that is difficult to reproduce. The core demand of these endpoints is: protect core data without interfering with design work.
2. Office endpoints carry the daily business of finance, HR, procurement, sales, and other departments. These endpoints are enormous in number, and their security needs are relatively standard—preventing business secrets from leaking, preventing malware intrusion, and ensuring software compliance. But the sheer number means extremely high management complexity. Endpoint-by-endpoint O&M is unrealistic, and automated tools are essential. The core demand of these endpoints is: batch control, unified policies.
3. Industrial control endpoints in precision manufacturing workshops run on key processes such as grinding, polishing, coating, and inspection. The processing cycle of a high-precision aspherical lens may last for weeks. If the industrial control computer experiences a system failure or unexpected restart midway, the lens being processed may be directly scrapped. The management logic of these endpoints is completely opposite to that of office computers: office computers emphasize updating at any time, while production line hosts emphasize not moving anything carelessly. System stability without downtime is the overriding principle.
Three types of endpoints, three sets of completely opposite management logic. When they are covered by the same policy system, the security system experiences systemic failure—either R&D endpoints are over-controlled and designers cannot work; or industrial control endpoints are updated carelessly and production lines halt; or office endpoints are under-controlled, leaving hidden leak risks.
Part Two: When Optical Files Meet Generic DLP
Core data in the electro-optical industry has a characteristic that gives security teams a headache: highly specialized formats that generic control methods cannot identify.
A Zemax design file (.zmx) may be released as an ordinary binary file in a generic DLP system, when it actually contains hundreds of key parameters such as lens curvature radius, material refractive index, air spacing, and coating parameters—competitors who obtain these parameters can directly copy or reverse-engineer the product design.
A CodeV .seq file, a LightTools .len file, and a FRED .frd file similarly face the dilemma of being “unreadable” in generic DLP systems. Security teams can only rely on file extensions for coarse-grained control, while pirated software and malicious actors can easily bypass detection by simply changing the extension.
More troublesome still, the legitimate licensing fees for optical design software are extremely high. A single Zemax license may cost hundreds of thousands of yuan, and a CodeV license is similarly expensive. This has led to the use of pirated software being not uncommon in the industry. Pirated software not only brings legal risks but may also carry Trojans or backdoors, becoming a covert channel for data leakage.
Generic DLP cannot control optical design files, generic software management cannot control pirated optical software, and generic encryption solutions cannot withstand the operating load of optical design software—these three “cannot control” factors constitute the core pain points of endpoint security management in the electro-optical industry.
Part Three: A Unified Platform Delivers Differentiated Policies
Ping64’s integrated office security platform does not cover all endpoints with a single set of policies, but configures differentiated security policies for three types of endpoints on a unified platform, while maintaining linkage between policies and correlation between data.
The concrete implementation of this approach in the electro-optical industry is reflected in the collaboration of capabilities at three levels.
Optical Design Workstations: Making Design Software “Usable” and Core Data “Impossible to Take Away”
Ping64’s approach is to determine protection attributes at the moment of file creation. When an optical design file is created or saved in Zemax or CodeV, the content identification engine automatically determines its sensitivity level and triggers corresponding protection actions. Ping64 supports deep identification of optical design file formats, accurately distinguishing a Zemax file from an ordinary document, ensuring that core optical parameters are correctly identified and protected.
On the endpoint side, transparent document encryption sinks encryption and decryption logic down to the operating system kernel layer. When authorized processes read or write specified file types, encryption and decryption are completed automatically, while unauthorized processes always receive ciphertext. The key lies in compatibility—Ping64 supports deep compatibility with mainstream optical design software and will not cause Zemax lag, CodeV ray tracing interruption, or file corruption due to encryption. Designers use familiar tools to edit files normally, unaware of the encryption process.
For outbound scenarios such as sending coating formulas to coating suppliers or providing drawings to precision machining plants, Ping64 deeply links the approval process with content identification, endpoint status, and recipient identity. After approval, the file automatically has tracing watermarks added, validity periods set, and tracing identifiers embedded. When a coating formula is leaked, the enterprise can quickly locate the source of the leak through watermark information.
Office Endpoints: From “Multi-Client Internal Friction” to “Integrated Governance”
Ping64 integrates capabilities such as admission control, software management, vulnerability management, data loss prevention, and endpoint detection and response into the same client. Employees only need to install one agent to obtain complete endpoint protection capabilities. The unified management console allows administrators to configure all policies in one place, with one configuration taking effect across the entire network.
At the level of software compliance management, Ping64 centers on the three goals of “visible, controllable, and manageable,” providing full-process governance of software from installation and use to external risks. For professional software such as Zemax, CodeV, LightTools, and SolidWorks widely used in optical enterprises, Ping64 achieves fine-grained management through a blacklist and whitelist mechanism. Enterprises can include authorized software in the whitelist and include high-risk or non-compliant software in the blacklist. For software that has genuine business needs but is not on the whitelist, employees can initiate an installation request through the system. After administrator review, installation permissions are opened within a specified period.
Ping64’s software compliance management capability not only helps enterprises avoid legal risks but also provides a basis for enterprises’ legalization procurement decisions through software asset inventory—which software is frequently used, which departments have the most concentrated needs, and which alternative solutions are most feasible.
Industrial Control Endpoints: Differentiated Control with Stability as Priority
Ping64’s design logic in industrial control endpoint scenarios is completely different from that of office endpoints.
Peripheral port control is the first gateway. External maintenance, equipment vendor debugging, and process parameter import—USB drives are an unavoidable channel. Ping64’s approach is: only registered USB drives are recognized, and private drives have no response when inserted; plug-in records and file operation records are retained together, making it possible to trace which drive, when, and what was copied. Bluetooth, wireless network cards, optical drives, and serial ports are brought under unified control. With one less writable entry point, the probability of line stoppage is reduced by one point.
System privilege control is the second gateway. Registry, Group Policy, Device Manager, Task Manager, Control Panel, and Safe Mode are disabled according to policies; IP addresses and computer names are not allowed to be modified arbitrarily. Installing new software is prohibited, and only software within the enterprise software library or whitelisted installation packages are allowed; blacklists and whitelists are set for installed software, and violating processes trigger alerts when they run.
Patch management is executed according to production line rhythm. Ping64 supports unified patch statistics and distribution, with timing selected during production line stoppage windows or idle periods. Restarting the entire factory at the same time is unrealistic for production lines.
Network communication whitelist control. Privately connecting mobile hotspots, connecting to external WiFi, and dual network card switching are identified. After triggering an alert, network disconnection and screen locking can be linked. Industrial control endpoints are only allowed to communicate with specified host computers, inspection instruments, and MES systems, and all other network requests are intercepted.
Part Four: Special Protection for Optical Drawings
Optical drawings are the most core knowledge assets of the electro-optical industry and one of the most difficult file types to manage. Ping64’s special protection capabilities for optical drawings are reflected at three levels.
- At the format identification level, the system supports deep identification of mainstream optical design software file formats such as Zemax, CodeV, LightTools, and FRED, accurately determining file types and sensitivity levels.
- At the content identification level, the system can extract key parameters from optical drawings—curvature radius, refractive index, number of coating layers, etc.—and compare them with a preset sensitive parameter library. Even if files are renamed or compressed and packaged, they can still be accurately identified.
- At the flow control level, the outbound transfer of optical drawings requires a strict approval process. After approval, tracing watermarks are automatically added, and when an outbound file is leaked, the source can be traced through watermark information. For optical drawing exchanges with external partners, Ping64 supports controlled outbound formats: files are transmitted in encrypted form, and the recipient needs to open them in a specified environment. Upon opening, it automatically connects to the verification server for identity verification and permission checks. Files cannot be forwarded, copied, or saved as other formats, ensuring the secure flow of core optical parameters in the supply chain.
Part Five: Where Exactly Is the Integrated Platform “Integrated”?
Integrating the security management of R&D endpoints, office endpoints, and industrial control endpoints on the same platform provides advantages that can be summarized as three “sames.”
Same-source policies. The security policies for the three types of endpoints are different—R&D endpoints focus on data encryption and outbound approval, office endpoints focus on software compliance and peripheral control, and industrial control endpoints focus on system stability and network whitelists. But these policies are centrally configured in the Ping64 unified policy center, and enterprises can flexibly combine policies according to endpoint type, department, and position, with one configuration taking effect across the entire network.
Same data foundation. In a multi-system architecture, outbound records of R&D endpoints, security logs of office endpoints, and operation logs of industrial control endpoints are stored in different systems, and post-event tracing requires manual reconstruction. Ping64’s security modules run on the same data foundation. Endpoint operation logs, file flow records, outbound approval records, and screen recordings share the same file identifier and user identifier at the moment they are generated, and correlation is natural, real-time, and accurate.
Same response chain. When a security module discovers a risk, it can immediately invoke other modules to execute response actions. When ransomware characteristics are detected on an industrial control endpoint, the system automatically blocks the endpoint’s network communication, captures a process snapshot, and notifies administrators, linking with the firewall to form an automated closed loop of “detection—assessment—response—recovery.”
Conclusion: Making Every Beam of Data Traceable
Endpoint security management in the electro-optical industry is moving from “passive firefighting” to “proactive closed loop.” The path to this transformation is not to add more security tools, but to integrate the security capabilities of different types of endpoints on the same platform, allowing policies to be executed differentially within a unified framework, data to be naturally correlated on a unified foundation, and responses to flow automatically within a unified engine.
What the Ping64 integrated office security platform provides for the electro-optical industry is precisely such a governance logic: unified endpoint management to achieve network-wide visibility of endpoint assets, differentiated policies to meet the different security needs of R&D, office, and industrial control endpoints, and platform-based linkage to build a complete security closed loop from endpoint to outbound, from usage to auditing.
In an era where high-end optical manufacturing is increasingly precise, supply chain collaboration is increasingly globalized, and confidentiality requirements in military and aerospace fields continue to escalate, endpoint security management is no longer a problem that can be remedied after the fact. Making every endpoint—whether an optical design workstation, an office PC, or an industrial control computer in a precision machining workshop—operate under a unified security framework may be the most pragmatic protection for the core intellectual property of the electro-optical industry.
Contact
14 min 
