搜索
OPCUnifiedArchitecture-ConnectivityGuideJanuary,2010Ref.01.02©KepwareTechnologiesTableofContents1. Overview................................................................................................1 2. Prerequisites...........................................................................................1 3. Security..................................................................................................2 3.1 Automatic.....................................................................................2 3.2 Exchange......................................................................................3 3.3 Manual.........................................................................................7 4. SettinguptheServer.............................................................................11 4.1 Endpoints....................................................................................11 4.2 Firewall.......................................................................................13 5. SettingupaDiscoveryService(Optional)..................................................15 5.1 Server........................................................................................15 5.2 OPCFoundation...........................................................................17 6. SettinguptheClient...............................................................................22 6.1 OPCUAClientChannel..................................................................22 6.2 OPCUAClientDevice....................................................................26 6.3 Verification..................................................................................28 7. Summary..............................................................................................28 ________________________________________________________________________________________’sRemoteProcedureCallandhasbeenthetargetofmanymaliciousattacks.SohowcanasafeandsecureremoteOPCconnectionbeestablished?ThesolutioncomesintheformofanewspecificationknownasOPCUnifiedArchitecture(OPCUA).OPCUAdoesnotrequirecallbacksandtheuseofDCOMforremoteconnections.ThisgreatlysimplifiesfirewallconfigurationandcompletelyeliminatestheheadacheknownasDCOM.TheOPCTunnelisnotaproductinitself,butratherafeaturethatiscreatedoutofexistingcomponentsthatareavailable.Thetunnelrequiresthesameclient-serverarchitectureasanyOPCproduct;however,theclientandserverbothneedtohaveOPCUAsupport.Inthiscase,ithappensthattheclientandtheserverarepartofthesameproductpackage.TheOPCUAserverispackagedinwiththeOPCDA,nativeinterfaceand,insomecases,DDEservers.Bydefault,theOPCUAserverisrunningandwaitingforlocalconnectionsimmediatelyaftertheproducthasbeeninstalled.Minorconfigurationchangesarerequiredtoallowremoteconnections.TheOPCUAclientisactuallyadriverchannelthatcanbeaddedalongwithanyotherdevicechannel.Ifrequired,anOPCUAclientandanOPCUAservercanbothberunningonthesamecomputerandbesharingdatawitharemotecomputerwiththesameconfiguration.Theresultisaconnectionbetweentworemoteserverswiththeabilitytoeasilyshareitemsinasecureway.2.PrerequisitesInstalltheserverapplicationontheclientcomputerandincludeOPCUAClientontheSelectFeaturespageunderCommunicationDrivers.Installtheserverapplicationontheservercomputer.SinceUAfunctionalityisincluded,noadditionalfeaturesneedtobeselectedduringtheinstall.Somesituationsaregoingtorequirethateachcomputeractasaserveraswellasaclient.Ifso,installtheOPCUAClientdriveroneachcomputerthatneedstoaccessitemsremotely.________________________________________________________________________________________’soperatingsystemtosecuretheapplications,OPCUAusesX.509authenticationtechnology.Thistechnologyconsistsofasetofpublicandprivatekeysforeachentitywishingtoestablishatrust.Theprivatekeyisprotectedwhilethepublickeyisplacedintoacertificatefordistribution.Inordertoestablishasecureconnectionbetweenaclientandtheserver,theircertificatesmustfirstbe“swapped”andalso“trusted”.Theswapisonlyrequiredtobedoneonceforthelifetimeofthecertificate.Thereareafewoptionswhendecidinghowtoswapcertificates:automatic,exchange,andmanual.Theautomatictrustcanbeestablishedduringruntimewhentheclientfirstattemptstoconnecttotheserver.SeveralUAclientandserverapplicationssupportthisfeatureandmostpresentadialogrequestingthattheusertrustorrejecttheincomingcertificate.BecausetheRuntimedoesn’tinteractwiththedesktop,anextrastepmayberequiredontheserverto“Trust”thecertificateonceithasbeenswapped.Theexchangeispreformedfromtheclientsideandonlytakesaninstanttocomplete;however,theserve