HIVE GATEWAY — WINDOWS 10 / 11 x64

ONE-TIME LICENSE ACTIVATION — VERSION 0.3.7

Activate online once after the administrator grants VPN Client at https://lic.hiveautomation.in/. Perpetual is the default; licensing then works offline without a grace period or renewal check. Optional expiry dates are enforced locally.

For a permanently offline PC, choose Export request, transfer the .hiverequest file to an online computer, import it in License Manager, grant it and download its License file. Transfer the .hivelicense file back and choose Import license in the application. The License button in Settings imports later updates. Offline revocation also requires an imported revocation file.

Update the VPN service to 0.3.7 or later from Settings. Licensing and the computer/site approval below are separate requirements.

1. Install Hive Gateway. If prompted, complete the official WireGuard component setup.
2. Open Hive and enter a name for this computer.
3. Choose Technician on the engineer's PC. Choose Site Gateway on the computer beside the PLC, then select its PLC Ethernet adapter, subnet and discovery profile.
4. Choose Request approval and share the displayed approval code with your Hive administrator. You can close the app or go offline. Your administrator can approve the computer while it is offline; Hive collects the approval automatically the next time the app opens or reconnects. No shared password or enrollment phrase is needed.
5. Complete the one-time VPN service setup on both computers, then open Hive normally. After approval, connect the VPN on the site gateway and the technician PC. Daily VPN use does not require Run as administrator.
6. Select the site and run PLC discovery. Siemens / PROFINET discovery requires Npcap installed separately on the site computer. Use the discovered IP in your engineering software.
7. For attended desktop support, choose Remote desktop. The site operator must allow viewing or control and can stop sharing at any time.
8. To help another technician, open Technicians, select their online computer and choose Request remote support. Clear Request keyboard and mouse control for viewing only. They must approve each session on their computer. Permission is never remembered; either person can end the session. Both computers need Hive open and connected; the PLC VPN is not required for desktop support.

Keep Hive open for discovery and desktop support. Every Windows installation/account needs its own approval. Contact your administrator if access is revoked or setup needs to be restarted.

Engineering preview: verify your PLC model and two-computer connection before field use. Unattended desktop access is not included. Each remote session requires fresh permission.

NEW IN 0.3.0

- Remote desktop automatically adjusts resolution, image quality and frame rate to the connection. Update both computers for this mode. The site gateway can stay minimized while sharing continues; locking Windows or opening its secure desktop pauses sharing.
- Full screen and monitor selection are available in the viewer. Switching remote monitors requires the recipient's permission for that session.
- After the other person allows control, click the remote picture to enable keyboard and mouse and send that click. No checkbox step is needed. Ctrl+Esc releases control; clicking the picture takes control again. View-only sessions cannot enable input.
- Input releases when the viewer loses focus, the remote desktop locks/pauses, or screen frames stop arriving for five seconds. A fresh frame from the selected monitor is required before clicking to resume. A Windows-blocked input notice requires resolving the Windows restriction; screen viewing can continue.
- File transfer requires session permission and acceptance of each incoming file. Open Session tools to send files or paste copied files, or drag files onto the viewer. Progress and cancellation are shown. After an interruption, select the same unchanged file in a new approved session to resume the retained partial. Hive verifies the complete file before saving it. Existing files are not overwritten and received files do not open automatically. Folders are not supported.
- Text clipboard sharing is separate from keyboard/mouse permission. Both participants must enable it for the current session. Session tools shows its state. Text is limited to 6,000 characters.
- Connection diagnostics checks internet, relay, VPN, the selected PLC adapter, userspace forwarding and an optional PLC IP/port. Diagnostics does not write to PLCs.
- Site activity and notes shows other connected technicians, support sessions, notes and maintenance reservations.
- Preferences offers optional startup at Windows sign-in, relay recovery, restoring an existing matching VPN tunnel and verified updates while idle. Incoming desktop requests still require consent.
- Your administrator assigns customer/site access to approved technician computers and can review history, CSV exports and portal alerts. Individual technician accounts and MFA are not part of this release.
- Hive update metadata has an owner signature and installers are checked by size and SHA-256. A Windows-trusted Authenticode publisher certificate is not yet available; Windows may still show an unknown publisher.

AUTOMATIC UPDATES IN 0.3.1

Install this setup once on both computers to receive future automatic updates. Existing computer approval and identity are kept. In Settings > Startup and updates, confirm "Automatically download verified updates and install when idle" is checked. New settings and older settings without an update preference enable it by default; an explicit saved opt-out stays off.

Hive checks every six hours while connected. A failed check retries after fifteen minutes. It downloads only a release with a valid Hive signature and verifies its size and SHA-256. Installation waits until support sessions, PLC discovery, other active operations and VPN are idle, then restarts Hive. A failed startup restores and relaunches the previous executable. Portable copies require manual setup installation. A trusted Windows publisher signature still requires the owner's code-signing certificate.

VPN SETUP ON THE PLC-SITE COMPUTER

NEW IN 0.3.3: WINDOWS VPN SERVICE AND USERSPACE PLC GATEWAY

Open the latest setup normally under the Windows account that uses Hive. Leave "Set up VPN service" checked and approve its one-time Windows administrator prompt. Setup installs the protected Hive Gateway VPN service and the official WireGuard component if needed. Open Hive normally afterward: Connect VPN and Disconnect VPN no longer require Run as administrator. Existing computer approval is retained. If the app updated automatically from an older release, open Settings > Set up VPN service once to finish this first service installation.

The service starts automatically with Windows. It accepts only the Windows account registered at setup and retrieves approved VPN settings from Hive; it does not expose a general command interface. App and service updates use the existing Hive signature key, verify file hashes and wait for idle VPN/support sessions. Service startup/health failure restores the previous service. Updating an already-installed service does not ask for administrator approval again. Repair, removal or moving ownership to another Windows account requires administrator approval. Service removal keeps protected version files and saved app approval for recovery.

The site gateway handles WireGuard in userspace and forwards approved TCP/UDP connections through the selected PLC Ethernet address. Hyper-V, Windows NAT and WinDivert are not required. No PLC/router return route needs changing. Native Windows ping is relayed only after the PLC actually answers; other IP protocols and general Ethernet bridging are not supported. Large IPv4 UDP datagrams are reassembled and forwarded with valid fragmentation on replies. Validate programming and upload/download behavior with each PLC model before field use. Discovery runs on the site computer; Layer 2 discovery is not bridged to the technician's engineering software.

Open Hive normally under the approved Windows account after its one-time VPN service setup. Connect Hive and then Connect VPN on the Site Gateway first. On the Technician, connect Hive, select the site, then Connect VPN. Wait for handshake verified status on both computers before testing a known PLC IP. A hub handshake does not by itself prove that the PLC is reachable. Keep the site PC awake and its PLC Ethernet adapter connected. An explicitly connected site gateway resumes after a service/Windows restart when its saved adapter is available; Disconnect VPN clears that saved connection.

The technician computer uses the official WireGuard component and one-time VPN service setup; neither computer needs Hyper-V for Hive VPN. Screen sharing works separately from PLC VPN, requires Hive connected on both computers and fresh permission for every session. The Windows login screen, UAC secure desktop and controlling elevated applications from a normal app remain restricted by Windows.

NEW IN 0.3.4: APPROVAL RECOVERY

If Hive says this computer needs approval again, its saved credentials were rejected by the server. Hive stops retrying and shows Request approval again. Click it, review the saved name, role and PLC network, then choose Request approval. The administrator must approve the new code. Existing valid approvals are retained across updates; a removed/revoked registration needs fresh approval. Technician site/customer assignments may also need to be assigned to the new registration.

The old identity is backed up in encrypted form before explicit recovery. No password, private key or administrator credential is displayed. Startup/update preferences are retained. Verified update checks remain available when Hive is disconnected or approval is rejected, so a computer can receive application fixes without regaining PLC or remote-support access.

