Attention

You are viewing an older version of the documentation. The latest version is v3.3.

Application #3: OPC UA Secure Communication¶

The following section is applicable to:

Important

Edge Control Protocol Bridge features must be enabled in the ECI image before Edge Control Protocol Bridge can be used. Creating an ECI image that contains the Edge Control Protocol Bridge features can be accomplished by selecting the EC Protocol Bridge feature option during image setup. See section Building ECI for more information.

../../_images/option_ec-protocol-bridge1.png

The OPC UA Secure Communication examples demonstrate encrypted communication between the OPC UA plugin and OPC UA applications. An example which utilizes TEP (Trusted VM for IoT Platforms) to decrypt a private key is also demonstrated.

Sign and Encrypt - Plaintext Private Key¶

In this example, the OPC UA plugin will establish an encrypted communication channel between two OPC UA server applications using a plaintext private key.

Prerequisites

An ECI image built with the EC Protocol Bridge feature option enabled. See section Building ECI for more information.
The ECI image is installed and booted on a target system. See section Installing ECI Images for more information.
Elevated user permissions.

Description

In this example, the following steps occur:

A plaintext private key is created.

Attention

Be sure to keep the plaintext private key secure at all times. If an adversary were to obtain the plaintext private key, they would have the ability to connect a rogue client to the OPC UA server and monitor/modify data! To mitigate this attack vector, an encrypted private key should be used. See section Sign and Encrypt - Encrypted Private Key for more information.
A secured OPA UA server application (Origin) is started. Another secured OPC UA server application (Logger) is started which simply prints the current values of its dataset to the console.
The OPC UA plugin establishes a secure connection to both OPC UA server applications (Origin & Logger) using the private key.
The OPC UA plugin will read the dataset from the Origin application, and write the dataset to the Logger application.
If the dataset values in the Origin application are modified, this change will propagate to the Logger application via the OPC UA plugin, resulting in the modified dataset values being printed to the console.

Procedure

Follow the steps below to complete the example:

Run the key-auth-local.sh script to execute this example:
```
$ /opt/ec-protocol-bridge/plg-opcua-rt/examples/sign_and_encrypt/key-auth-local.sh
```
See also

For a manual step-by-step breakdown of this script, refer to section: Example #4: Secure OPC UA Client Read & Write.

Expected Results

The Origin and Logger servers will exchange data securely, facilitated by the OPC UA plugin client which connects to both servers. Data on the Origin server will be mirrored on the Logger server, and the (3:Counter) node will increment periodically.

OPCUA Client Read Nodeset for Dataset: opcua-client-ds
Read Node: (6:Int32)  Value: 0
Read Node: (6:Float)  Value: 0.000000
Read Node: (6:String)  Value: unknown
Read Node: (3:Counter)  Value: 12
Called queue_databuf() to queue Client data
Called queue_databuf() to queue Listener data
Data stored to Client Write Queue for Dataset: opcua-sim-ds2
OPCUA Client Write Nodeset for Dataset: opcua-sim-ds2
Write Node: (6:Int32) Value: 0
Write Node: (6:Float) Value: 0.000000
Write Node: (6:String) Value: unknown
Write Node: (3:Counter) Value: 12
OPCUA Client Read Nodeset for Dataset: opcua-client-ds2
Read Node: (6:Int32)  Value: 0
Read Node: (6:Float)  Value: 0.000000
Read Node: (6:String)  Value: unknown
Read Node: (3:Counter)  Value: 12

Alternatively, follow the steps below to verify that the data is read from one server, passing through the plugin, and written to the other server:

Open an OPC UA client, such as UaExpert.
Connect one client to opc.tcp://#.#.#.#:53530 where #.#.#.# is the ip address of the system running the EC Protocol Bridge. This is the Origin server.
Connect one client to opc.tcp://#.#.#.#:53550 where #.#.#.# is the ip address of the system running the EC Protocol Bridge. This is the Logger server.
Update the uint32 node on the Origin server. The uint32 node on the Logger server should change to be the same value.

Sign and Encrypt - Encrypted Private Key¶

In this example, the OPC UA plugin will establish an encrypted communication channel between two OPC UA server applications using an encrypted private key which is decrypted using a symmetrical AES stored on a discrete TPM via TEP (Trusted VM for IoT Platforms).