ABB Month DD, YYYY Slide 1

Transcription

1 Stefan-Helmut Leitner, ABB Corporate Research Germany, Zukunft der Netze 2011, Hamburg Secure Communication in Industrial Automation by Applying OPC UA Month DD, YYYY Slide 1

2 Agenda Industrial Automation Classic OPC and OPC UA? All problems solved? Future? Month DD, YYYY Slide 2

3 Supervision Industrial Automation Industrial Automation deals with automation of manufacturing processes Intervention Input Manufcturing Process Output Month DD, YYYY Slide 3 Automotive Food Paper

4 Industrial Automation Plant supervision and control Interaction with Business IT Systems Process supervision and intervention Process data acquisition and device control Process data acquisition and device control Month DD, YYYY Slide 4 Input Manufacturing Process Output

5 Industrial Automation Differences compared to Business IT Availability has highest security goal Safety is (often) more important than security Long system lifetime (<20 years without interruption) Other Challenges Increasing interconnectivity Increasing usage of COTS and Open Source Interoperability and standardization Example: OPC Month DD, YYYY Slide 5

6 Classic OPC and OPC UA Application X... Application Y Controller Field Devices Control System OPC Widely adopted industry standard Data exchange with process devices Pure interface specification Display Application OPC Trend Application OPC Based on Microsoft COM/DCOM Deficiencies Technology Dependency (COM/DCOM retires) Complicated security configuration Controller Field Device Control System Security not sufficiently considered in architecture

7 Classic OPC and OPC UA Display Application OPC Controller Field Device Trend Application OPC Control System OPC UA Abstract protocol specification and concrete technology mappings Service-oriented Architecture More areas of applications incl. embedded systems Benefits compared to OPC Controller Display Application Field Device Trend Application Control System Reduced technology or vendor dependency Security is inherent part of architecture and implementation Simplified security onfiguration Month DD, YYYY Slide 7 OPC UA

8 Classic OPC and OPC UA Reduced technology or vendor dependency Specification Abstract service and technology mappings Abstract Services Allows adding new mappings in case of security vulnerabilities! Technology Mapping 1 Technology Mapping 2 Protocol Stack Implementation Minimal platform-dependent layer Allows replacing libraries in case of security vulnerabilities! OPC UA Client/Server OPC UA Stack Platform Layer Month DD, YYYY Slide 8

9 Classic OPC and OPC UA Security is inherent part of architecture and implementation HTTPs Month DD, YYYY Slide 9

10 Classic OPC and OPC UA Simplified security configuration Few well-defined security policies Consistent set of security-related configuration for communication Algorithms for encryption and digital signatures Type of user credentials Agreement of applied security can be done by Pre-configuration by client Selection after server discovery Automatic negotiation between client and server Month DD, YYYY Slide 10

11 Classic OPC and OPC UA Simplified security configuration OPC UA Discovery Server 1. Where are the servers? OPC UA Client Well-known Endpoint 2. What session endpoints are available and how can I access them? Discovery Endpoint OPC UA Server 0. Register (What does the server support? Session Endpoint Month DD, YYYY Slide 11 Alternative: Offline Configuration and skip step 0, 1 and 2 3. Connect to the session endpoint.

12 Classic OPC and OPC UA and where are remaining challenges? OPC UA requires up to three types of digital certificates for different purposes! Publik Key Infrastructure required which requires significant efforts. Usage of digital certificates is quite new to automation Learning curve is still required Dealing with certificates in controllers Limited resources (processing power, memory) Long lifetime without interruption (up to years) Month DD, YYYY Slide 12 Poor entropy sources

13 All problems solved? Reduced technology dependency Security is inherent part of architecture and implementation Simplified security configuration Month DD, YYYY Slide 13

14 Future? Security impact of Cloud Computing Headquarter Factory Factory Month DD, YYYY Slide 14

15