Name

Type

Description

Request

requestHeader

RequestHeader

Common request parameters. The authenticationToken is always null.

The type RequestHeader is defined in 7.28.

clientCertificate

ApplicationInstance‌Certificate

A Certificate that identifies the Client.

The OpenSecureChannel request shall be signed with the private key for this Certificate.

The ApplicationInstanceCertificate type is defined in 7.2.

If the securityPolicyUri is None, the Server shall ignore the ApplicationInstanceCertificate.

requestType

Enum

SecurityToken RequestType

The type of SecurityToken request:

An enumeration that shall be one of the following:

ISSUE_0creates a new SecurityToken for a new SecureChannel.

RENEW_1creates a new SecurityToken for an existing SecureChannel.

secureChannelId

BaseDataType

The identifier for the SecureChannel that the new token should belong to. This parameter shall be null when creating a new SecureChannel.

The concrete security protocol definition in OPC 10000-6 chooses the concrete DataType.

securityMode

Enum

MessageSecurityMode

The type of security to apply to the messages.

The type MessageSecurityMode type is defined in 7.15.

A SecureChannel may have to be created even if the securityMode is NONE. The exact behaviour depends on the mapping used and is described in the OPC 10000-6.

securityPolicyUri

String

The URI for SecurityPolicy to use when securing messages sent over the SecureChannel.

The set of known URIs and the SecurityPolicies associated with them are defined in OPC 10000-7.

clientNonce

ByteString

A random number that shall not be used in any other request. A new clientNonce shall be generated for each time a SecureChannel is renewed.

This parameter shall have a length equal to the SecureChannelNonceLength defined for the SecurityPolicy in OPC 10000-7. The SecurityPolicy is identified by the securityPolicyUri.

requestedLifetime

Duration

The requested lifetime, in milliseconds, for the new SecurityToken. It specifies when the Client expects to renew the SecureChannel by calling the OpenSecureChannel Service again. If a SecureChannel is not renewed, then all Messages sent using the current SecurityTokens shall be rejected by the receiver.

Several cryptanalytic attacks become easier as more material encrypted with a specific key is available. By limiting the amount of data processed using a particular key, those attacks are made more difficult. Therefore the volume of data exchanged between Client and Server must be limited by establishing a new SecurityToken after the lifetime.

The setting of the requested lifetime depends on the expected number of exchanged messages and their size in the lifetime. A higher volume of data requires shorter lifetime.

Response

responseHeader

ResponseHeader

Common response parameters (see 7.29 for ResponseHeader type definition).

securityToken

ChannelSecurityToken

Describes the new SecurityToken issued by the Server. This structure is defined in-line with the following indented items.

channelId

BaseDataType

A unique identifier for the SecureChannel. This is the identifier that shall be supplied whenever the SecureChannel is renewed.

The concrete security protocol definition in OPC 10000-6 chooses the concrete DataType.

tokenId

ByteString

A unique identifier for a single SecurityToken within the channel. This is the identifier that shall be passed with each Message secured with the SecurityToken.

createdAt

UtcTime

The time when the SecurityToken was created.

revisedLifetime

Duration

The lifetime of the SecurityToken in milliseconds. The UTC expiration time for the token may be calculated by adding the lifetime to the createdAt time.

serverNonce

ByteString

A random number that shall not be used in any other request. A new serverNonce shall be generated for each time a SecureChannel is renewed.

This parameter shall have a length equal to the SecureChannelNonceLength defined for the SecurityPolicy in OPC 10000-7. The SecurityPolicy is identified by the securityPolicyUri.