How to Add OPC UA Security to a Legacy OPC DA System

Legacy OPC Classic DA systems can gain modern OPC UA security features without requiring a full migration or replacement of existing OPC servers. OPC Expert Security Gateway connects to your OPC DA server as a client, ingests the data, and then re-publishes it through an OPC UA server with full security controls enabled. Client applications connect to the UA endpoint and benefit from encryption, certificate-based trust, and user authentication, while the OPC DA server continues to operate unchanged.

The Security Gap in OPC Classic

OPC Classic was built on Microsoft DCOM, which was designed for local area network communication in an era when industrial systems were largely air-gapped. DCOM offers very limited security controls. Authentication is tied to Windows accounts and DCOM configuration, there is no native support for encryption, and there is no built-in mechanism to restrict which tags or branches of the namespace a specific client can access. The OPC Foundation developed OPC UA specifically to address these limitations with a modern, platform-independent security architecture. Once a client authenticates at the DCOM level, it typically has full read and write access to everything the OPC server exposes.

This design makes OPC Classic servers difficult to protect when they need to share data across network boundaries, with IT-side applications, or with external systems. The typical response is to leave them on a flat OT network and rely entirely on perimeter controls, which is an increasingly inadequate approach as IT and OT networks converge.

How the Gateway Wraps OPC DA in OPC UA Security

OPC Expert Security Gateway acts as an intermediary. It connects to the OPC DA server from the same network using standard DCOM communication, which the DA server handles normally. The gateway then publishes the data it has collected through a built-in OPC UA server. This OPC UA server is the endpoint that external clients see and connect to.

Because the OPC UA server is managed by the gateway, you have full control over its security configuration. You can remove insecure endpoints, require sign-and-encrypt communication, enforce certificate trust for every connecting client, and apply user authentication. You can also define access control policies that restrict which users can browse, read, or write specific tags or folders. None of this requires any modification to the underlying OPC DA server. From the DA server’s perspective, it simply has one trusted OPC client connected to it.

Protocol Conversion Is Built Into the Architecture

The conversion between OPC DA and OPC UA is built into OPC Expert’s core architecture, not a separate add-on step. When you configure the gateway to publish OPC DA data through a UA endpoint, it handles the mapping of DA data structures to UA node hierarchies and translates data quality codes and timestamps appropriately. Client applications connecting via OPC UA receive data in standard UA format and do not need to know anything about the OPC DA server behind the gateway.

This also means the gateway can accept connections from modern OPC UA clients, including those on other operating systems or platforms that may not support OPC Classic at all, and those clients gain access to data from your legacy DA infrastructure without requiring DCOM to be configured across network boundaries.

Relevant Tools

OPC Security Gateway is the primary module for this use case. It connects to OPC DA servers as a client, enforces security policies on the OPC UA side, and handles the protocol conversion transparently.

OPC Tunneler complements this capability when the OPC DA server and the gateway are on different network segments, by handling the secure transport of OPC data across firewalls without requiring DCOM port configuration.

Conclusion

You do not need to replace a functioning OPC Classic DA server to gain modern security features. OPC Expert Security Gateway wraps your DA server behind a fully secured OPC UA endpoint, giving you encryption, certificate trust, and granular access control without disrupting the existing OPC Classic infrastructure or requiring changes to the DA server configuration.