OPC UA Server Access Control via User-Certificate Mapping
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Industrial automation systems, such as those using the OPC UA protocol, face challenges in efficiently identifying users and associating them with appropriate privileges, leading to potential security vulnerabilities and inefficiencies in control actions.
Innovation Solution
The implementation of multiple mappings between users, Application Certificates, and user privileges allows the OPC UA server to efficiently identify users and restrict access based on these associations, without modifying existing OPC UA client or server security architectures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If traditional OPC UA security architecture is used, then existing client-server compatibility is maintained, but user identification and privilege association efficiency deteriorates
Solution Approach 1:
The patent introduces an intermediary mapping mechanism that sits between the OPC UA certificate verification and the controller access control. This mapping stores the relationship between user certificates and controller privileges, allowing the system to efficiently resolve user identities without modifying the existing OPC UA protocol flow. The intermediary layer translates certificate information into controller-specific privilege information, improving identification efficiency while preserving client-server compatibility.
Solution Approach 2:
The security architecture is segmented into distinct functional layers: certificate verification (handled by OPC UA), mapping lookup (handled by the data repository), and privilege enforcement (handled by the controller). This segmentation allows each component to operate independently at its optimal efficiency, with the mapping layer providing fast lookup operations without burdening the communication protocol or the access control logic.
2Measurement precision
If multiple mappings between users, certificates, and privileges are implemented, then access control precision improves, but data structure complexity increases
Solution Approach 1:
The mapping data structure is designed to be universal, supporting multiple users, multiple certificates per user, and multiple privileges per user within a single unified repository. This multi-functional design allows the same data structure to handle various access control scenarios without requiring separate structures for different cases, thereby improving access control precision while keeping the overall data structure manageable.
Solution Approach 2:
Instead of creating complex hierarchical data structures, the patent uses flat mapping tables that copy and store the essential relationships between users, certificates, and privileges. The first mapping stores user-certificate associations, and the second mapping stores user-privilege associations. This copying approach simplifies the data structure while maintaining precise access control by allowing direct lookup operations.
3Reliability
If user privilege retrieval uses multiple mappings, then security enforcement accuracy improves, but processing time increases
Solution Approach 1:
The mapping data structures are pre-populated with all user-certificate and user-privilege relationships before access control decisions are needed. This preliminary action allows the system to perform simple, fast lookup operations when a user attempts to access the controller, rather than performing complex calculations or queries at the moment of access. The mappings are established in advance, enabling constant-time or logarithmic-time retrieval operations.
Solution Approach 2:
The patent extracts the complex privilege determination logic from the real-time access control path and places it into the pre-computed mapping structures. When a user presents their certificate, the system only needs to extract the relevant information from the pre-existing mappings rather than recalculating privileges. This extraction separates the computationally intensive mapping setup phase from the fast lookup phase, improving real-time performance.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A system including a controller having a data repository configured to store a first mapping associating a user to an Application Certificate and a second mapping associating the user to a user privilege. The system further includes an OPC Unified Architecture (UA) server configured to provide server access based on receiving the Application Certificate from an OPC UA client and enforcing the user privilege, in which the user privilege is retrievable based on the first and the second mappings.