What Security Features Does OPC UA Offer for Industrial Communication?

OPC UA incorporates security at the protocol level, making it fundamentally different from OPC Classic which relied on Windows DCOM and its associated authentication challenges. OPC UA supports certificate-based mutual authentication, message signing, and message encryption, all defined within the OPC UA specification itself. These features are available regardless of the underlying transport layer and apply equally to local and remote connections.

Authentication and Certificate-Based Trust

OPC UA uses X.509 certificates to establish trust between a client and a server. Before a session is established, both parties exchange certificates and each verifies that the other’s certificate is trusted. Certificates can be issued by an enterprise certificate authority or self-signed, depending on the security policy applied. This mutual authentication prevents unauthorized clients from connecting to an OPC UA server and ensures the server the client is connecting to is the intended one, guarding against impersonation. OPC Expert supports certificate-based security for OPC UA connections, allowing administrators to manage trusted certificate stores and enforce security policies per connection.

Message Signing and Encryption

OPC UA defines three security modes: no security, sign only, and sign-and-encrypt. In sign-only mode, each message carries a digital signature that confirms it has not been tampered with in transit. In sign-and-encrypt mode, message content is also encrypted so that network observers cannot read the data. OPC Expert supports 128-bit and 256-bit encryption options using security libraries that comply with the OPC Foundation specifications. Encryption is applied at the session level, meaning all data exchanged within a session, including reads, writes, and subscription notifications, is protected by the selected security policy.

Access Control and Endpoint Security

Beyond transport security, OPC UA supports user-level access control through username and password credentials, Windows authentication, and certificate-based user identity. Different users can be granted different levels of access to server nodes, including read-only, write, or browse permissions. OPC Expert’s Security Gateway module extends this further by enforcing granular access restrictions per endpoint, certificate, and authentication method, adding a layer of control that goes beyond what most OPC UA servers provide natively.

Relevant Tools

OPC Security Gateway is the OPC Expert module that enforces granular access control across OPC UA, OPC DA, MQTT, and REST API communications. It adds authentication, encryption, and per-endpoint access policies to both legacy and modern OPC server configurations.

OPC Tunneler is the OPC Expert module that enables secure OPC communication across networks. It eliminates DCOM configuration requirements and supports OPC UA with optional encryption and Windows authentication for cross-network data transfer.

Summary

OPC UA delivers security at the protocol level through X.509 certificate authentication, message signing, and optional full encryption. OPC Expert supports the full range of OPC UA security modes and extends this foundation with its Security Gateway module, which provides granular access control and audit logging for industrial environments requiring strict security governance.