OPC UA Server Provisioning via Proxy and Registry Automation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In industrial automation systems, integrating OPC UA servers in virtualization environments like Docker containers is complex and error-prone due to manual configuration requirements for network addressing and certificate management, leading to inefficiencies and potential security issues.
Innovation Solution
A method combining a proxy, local discovery server (LDS), and global discovery service (GDS) with an internal registry instance (registrar) to automate the creation and distribution of certificates, treating software applications as hardware devices, ensuring secure and automated provisioning of OPC UA servers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual configuration is used for network addressing and certificate management in virtualization environments, then integration can be achieved, but the process becomes complex and error-prone
Solution Approach 1:
The system enables self-service automation where the OPC UA server automatically discovers available network ports through the proxy, retrieves appropriate certificates from the registry, and configures its endpoint addresses without manual intervention. This eliminates configuration errors while maintaining integration reliability.
Solution Approach 2:
The patent introduces intermediary components including a proxy that manages network port allocation and a registry that stores certificate information. These intermediaries mediate between the OPC UA server and the external environment, automatically resolving network addressing and security configuration issues.
2Productivity
If automated configuration is implemented for OPC UA servers in virtualization environments, then integration efficiency improves, but secure certificate distribution becomes challenging
Solution Approach 1:
The registry acts as a secure intermediary that stores certificates and distributes them automatically to OPC UA servers during runtime. This enables automated configuration while maintaining security through controlled certificate distribution, as the registry validates and manages certificate delivery without manual intervention.
Solution Approach 2:
Certificates are prepared and stored in the registry in advance before the OPC UA server needs them. This preliminary action allows the server to automatically retrieve valid certificates at runtime, ensuring both security through pre-validation and efficiency through automated deployment without manual certificate management.
3Adaptability or versatility
If multiple OPC UA servers are integrated in a virtualization environment, then service functionality increases, but port conflicts and configuration challenges arise
Solution Approach 1:
The proxy serves as an intermediary that automatically manages network port allocation for multiple OPC UA servers. It discovers available ports, assigns them to respective servers, and updates their endpoint addresses, enabling multiple servers to run simultaneously without port conflicts or manual configuration.
Solution Approach 2:
Each OPC UA server automatically queries the proxy for available network ports and receives configured endpoint addresses without manual intervention. This self-service mechanism enables multiple servers to be integrated efficiently, with the proxy autonomously resolving addressing conflicts and updating server configurations.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The participants in the Industrial Edge ecosystem want extensive automatic integration mechanisms, if possible without interfering with currently common OPC UA software stacks. The OPC UA server applications cannot however be externally accessed without further measures so that the user has to balance the server ports between the application view and the edge device view and must in the process consider port conflicts and compliance with possible network environment restrictions, as well as the other parts of its automation application with the servers via the concrete network addressing information. It is proposed to produce an initial trust relationship (with a "certificate of origin"). This certificate of origin/initial trust relationship corresponds to the CA certificate of the provision entity. In addition, it is proposed to expand a combination of "proxy plus local directory service (Local Discovery Server, LDS) plus internal directory service (Global Discovery Service, GDS) (140) by an internal registry entity or registrar. Technically, the registrar can be, for example, an extension of the internal directory service IGDS.