OPC UA provides options to take care of security aspects while exchanging data. The security level is specified via so called security policies. The following options exist as security policy:

  • None: no security measures taken
    This is already implemented in the OPC UA adapter by choosing unauthenticated under access mode.
  • Sign (username & password): integrity and authenticity are ensured via user authentication and authorization.
    This is already implemented in the OPC UA adapter by choosing Username/Password under access mode.
  • SignAndEncrypt: additionally, confidentiality is ensured. Identification of the user is done via a X509 certificate.
    This is not yet implemented.

There are three different options to handle the certificate management in the OPC UA server

  • Self-signed certificates and trust-list mechanism
    • Easy and flexible
    • Each certificate has to be registered at each server and added to the trust list to allow a connection
    • Only recommended for smaller OPC-UA set ups
  • Public key infrastructure (PKI) and trust-list mechanism
    • Trust-list contain only root certificates
    • New servers or clients get a certificate from the PKI, that can be validated via the root certificate
  • Certificate Manager (OPC UA component)
    • Enables not only provision of certificates but renewal and withdrawal of certificates
    • Not specified in the OPC UA standard -> product specific


To establish an encrypted connection to the OPC UA server the following preconditions have to be met:

  • Certificate is included in the server’s trust list
  • Certificate and private key are present to establish a connection


Possibilities to test:

  • Eclipse Milo supports encrypted communication via self signed certificates and trust-list mechanism. The demo server allows to add certificates to the trust list via upload (http://milo.digitalpetri.com/)


Next steps:

  • Establish encrypted connection via UA Expert with milo demo server
  • Implement functionality with eclipse milo in StreamPipes



References:


  • No labels