OPC UA Aggregating Server SSO Component Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The OPC UA protocol lacks mechanisms for user authentication and authorization, particularly in scenarios involving aggregating servers, which hinders secure access control and single sign-on capabilities essential for automation technology systems.
Innovation Solution
An OPC UA client transmits authentication data to an aggregating server, which uses an SSO component to authenticate the user across connected OPC UA servers, enabling fine-grained access control and transparent authentication through mapping user identities and utilizing the ActivateSession service.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a central authentication server using web protocols (HTTP) is implemented for single sign-on, then user authentication and authorization can be achieved, but the solution cannot be used in OPC UA systems because web protocols are not always available in automation networks and the authentication server would need to understand the OPC UA protocol which current products do not support
Solution Approach 1:
The patent introduces an SSO component as an intermediary module within the OPC UA server that mediates between the OPC UA protocol and authentication mechanisms. This component intercepts OPC UA service calls (specifically ActivateSession, createUser, deleteUser, setUserPassword, changePassword) and handles authentication logic internally, allowing the server to authenticate users without requiring external web-based authentication servers or understanding of HTTP protocols.
Solution Approach 2:
The OPC UA server is enhanced with built-in single sign-on functionality through the SSO component, enabling it to perform authentication services independently without relying on external authentication infrastructure. The server itself manages user credentials, session activation, and authorization decisions using its native OPC UA protocol, making the authentication system self-contained and protocol-agnostic.
2Ease of operation
If aggregating servers use parent user concepts for access, then simplified user management is achieved, but this breaks the design goals of fine-grained access control and least privileges protection
Solution Approach 1:
The patent segments the aggregation server's interaction with subordinate servers into individual user-level connections rather than using a single parent user account. Each user of the aggregating server maintains separate authentication credentials and session management for each subordinate server they access, enabling fine-grained access control where users only obtain permissions necessary for their specific tasks rather than blanket access through parent accounts.
Solution Approach 2:
The SSO component implements local user identity mapping at each subordinate server connection, where user credentials and permissions are tailored to the specific security requirements of each accessed server. This allows different authentication methods and permission sets to be applied locally at each server interface while maintaining a unified user experience through the OPC UA client.
3Reliability
If multiple independent authentication mechanisms are implemented for each OPC UA server, then fine-grained access control is achieved, but users must authenticate separately to each server increasing complexity and time
Solution Approach 1:
The SSO component merges multiple authentication operations into a single unified authentication flow. When a user establishes a session with an OPC UA server, the SSO component simultaneously handles credential verification, session activation, and permission retrieval across the OPC UA server hierarchy, eliminating the need for separate authentication steps at each server level.
Solution Approach 2:
The system performs preliminary authentication and session setup actions through the ActivateSession service call, which is intercepted and processed by the SSO component before the user accesses any subordinate servers. This preliminary authentication establishes user identity and permissions upfront, allowing subsequent server accesses to proceed without additional authentication overhead.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The invention relates to a method and a corresponding device for integrating single sign-on mechanisms in a client/server system using communication according to the standard protocol OPC UA, and for performing single sign-on for user authentication and authorization in such a system. An OPC UA client (21) is connected to an OPC UA aggregating server (24) in the system, and said server is in turn connected to subordinated OPC UA servers (1, 2, 3) by means of a communication network (22). In order to integrate single sign-on mechanisms, the OPC UA aggregating server (24) is expanded by an SSO component (25) for mapping user legitimation data (credentials) used in a service call to identities in the form in which said identities are stored in the subordinate OPC UA servers (1, 2, 3). In order to perform single sign-on using the SSO component (25), user legitimation data associated with a service call are used in order to automatically search for corresponding mapped identities and affected OPC UA servers (1, 2, 3), and to call up an active session service for each match in each OPC UA server (1, 2, 3) by means of the mapped identity, whereby the desired access to data from the service invocation of the user is established.