How an OPC Security Gateway Works and When to Use One

An OPC Security Gateway sits between your OPC servers and the clients that consume data from them. It connects to your OPC servers as a standard OPC client, collects the data, and then re-publishes it through its own OPC server endpoint while enforcing access control policies that the underlying servers cannot provide. OPC Expert Security Gateway is the right choice when your OPC servers do not offer the security granularity you need, or when you need to enforce consistent security across a mix of OPC Classic and OPC UA servers without modifying each one individually.

What Standard OPC Servers Can and Cannot Do

Most OPC servers, whether OPC Classic DA or OPC UA, offer connection-level security. For OPC Classic, this means you can require Windows authentication before a client can connect. For OPC UA, this means you can enable encryption and certificate validation as defined by the OPC Foundation security specifications. In both cases, however, once a client successfully connects, it typically has access to the entire namespace of the server. The server provides no mechanism to say that one user can read tags in one area of the namespace while a different user can only read a different subset.

This all-or-nothing model works when all clients should see all data. It becomes a problem when you need to share OPC data with multiple systems that have different access requirements, such as a business intelligence application that should see production rates but not control setpoints, or a remote operator who should read but not write.

How the Gateway Fills the Security Gap

OPC Expert Security Gateway addresses this by adding a security enforcement layer in front of your OPC servers. The gateway connects to each OPC server and makes all of its data available internally. External clients never connect to the OPC servers directly; they connect to the gateway’s OPC server endpoint instead.

When a client connects to the gateway, the gateway evaluates three things: the encryption security policy the client is using, the certificate the client presents, and the user account credentials it supplies. Each of these can be configured independently. You can require all three, or just one or two, depending on your requirements. After authentication, the access control list determines which folders and items that specific user or certificate is permitted to browse, read, or write. A client that passes authentication but lacks permission to a particular tag or folder will not see that tag at all when browsing.

When a Security Gateway Is the Right Choice

A security gateway adds value when your existing OPC servers do not provide the security controls you need and you cannot or do not want to replace them. It is also the right choice when you need to apply consistent security policies across multiple servers from different vendors, because the gateway presents a single, uniformly secured endpoint regardless of the backend server mix.

If your OPC server already offers granular access control, encryption, and certificate management, an additional gateway may not be necessary. The gateway is designed to fill security gaps, not to duplicate existing capabilities. If your current OPC servers allow you to restrict read and write access per user to specific namespace areas and control which encryption policies are accepted, you may already have sufficient security in place.

Relevant Tools

OPC Security Gateway is the OPC Expert module that performs the intermediary role described in this article. It supports OPC UA, OPC DA, OPC XML DA, MQTT, and REST API connections and runs as a Windows service for continuous availability.

OPC Viewer can be used alongside the gateway to test and verify that access policies are enforced correctly, by connecting as different users and confirming that each user sees only the data they are authorized to access.

between servers and clients and applying security policies that the servers themselves cannot enforce. Use one when you need granular per-user, per-item access control, when you need consistent security across a mixed server environment, or when you need to provide secured OPC access across a network boundary without exposing the underlying servers directly.