The routine work of a Clientapplication and a Serverapplication to transmit information, settings, and commands is done in a Session in the Application Layer. The Application Layer also manages the security objectives user Authenticationand user Authorization. The security objectives that are managed by the Application Layer are addressed by the Session Servicesthat are specified in OPC 10000-4. A Session in the Application Layer communicates over a Secure Channelthat is created in the Communication Layer and relies upon it for secure communication. All of the Session data is passed to the Communication Layer for further processing.
Impersonation allows a user to take ownership of an existing Session.
If a Secure Channelbreaks, the Session will remain valid for a period of time allowing the Clientto re-establish the connection to the Sessionvia a new Secure Channel.Otherwise, the Session closes after its lifetime expires.
The Communication Layer provides security mechanisms to meet Confidentiality, Integrityand application Authenticationas security objectives. One essential mechanism to meet these security objectives is to establish a Secure Channel(see 4.13) that is used to secure the communication between a Clientand a Server. The Secure Channelprovides encryption to maintain Confidentiality, Message Signatures to maintain Integrityand Certificatesto provide application Authentication. The data that comes from the Application Layer is secured and passes the “secured” data to the Transport Layer. The security mechanisms that are managed by the Communication Layer are provided by the Secure ChannelServices that are specified in OPC 10000-4.
The security mechanisms provided by the Secure Channelservices are implemented by a protocol stack that is chosen for the implementation. Mappings of the services to some of the protocol stack options are specified in OPC 10000-6which define how functions in the protocol stack are used to meet the OPC UA security objectives.
The Communication Layer can represent an OPC UA connection protocol stack. OPC UA specifies alternative stack mappings that can be used as the Communication Layer. These mappings are described in OPC 10000-6.
If the OPC UA Connection Protocol (UACP) is used, then functionality for Confidentiality, Integrity, application Authentication, and the Secure Channelare similar to the SSL/TLSspecifications, as described in OPC 10000-6.
The Transport Layer handles the transmission, reception, and the transport of data that is provided by the Communication Layer.
To survive the loss of the Transport Layer connections (e.g. TCP connections) and resume with a new connection, the Communication Layer is responsible for re-establishing the Transport Layer connection without interrupting the logical Secure Channel.
The transport layer can also be used to implement Confidentialityand Integrity by using HTTPS as described in OPC 10000-6. It is important to note that HTTPS certificates can be (and often are) shared by multiple applications on a platform and that they can be compromised outside of the OPC UA usage of them. All applications on the platform that use the same shared certificate have the same settings, such as disabling of SSLv2. HTTPS does not require application Authentication, if this is required it can be included as part of Sessionestablishment.
OPC UA provides a session-less Serviceinvocation (see OPC 10000-4overview and see OPC 10000-6for details). The session-less communication provides User Authentication. The communication channel provides Confidentialityand Integrity.The communication channel might be an OPC UA Secure channel (without a session). It might be a communication channel, such as HTTPS, which relies on transport protocols to provide security. In addition, User Authenticationand/or Application Authenticationcan also be established by the use of an AccessTokenwhich is obtained from an AuthorizationService (see OPC 10000-6for details).
Additional communication mappings are described in OPC 10000-6. These mappings may rely on transport protocols to provide Confidentialityand Integrity. One example is Websockets, which utilizes HTTPS transport layer security to provide Confidentialityand Integrity.