Search

Scope: Core (OPC-10000-*) All specs

12 result(s) for SecurityToken

OPC-10000-4 – OPC Unified Architecture - Part 4: Services

3.1.12 SecurityToken

SecurityToken identifier for a cryptographic key set Note 1 to entry: All SecurityTokens belong to a security context. For OPC UA the security context is the SecureChannel
OPC-10000-4 – OPC Unified Architecture - Part 4: Services

5.6.2.1 Description

from being discarded, the applications should do the following: Clients should request a new SecurityToken after 75 % of its lifetime has elapsed. This should ensure that Clients will receive ... SecurityToken before the old one actually expires. Servers shall use the existing SecurityToken to secure outgoing Messages until the SecurityToken expires or the Server receives a Message secured with
OPC-10000-4 – OPC Unified Architecture - Part 4: Services

5.6.2.2 Parameters

securityPolicyUri is None, the Server shall ignore the ApplicationInstanceCertificate . requestType Enum SecurityToken RequestType The type of SecurityToken request: An enumeration that shall be one of the following: ISSUE creates ... SecurityToken for a new SecureChannel . RENEW creates a new SecurityToken for an existing SecureChannel . secureChannelId BaseDataType The identifier for the SecureChannel that the new token should belong to. This parameter
OPC-10000-4 – OPC Unified Architecture - Part 4: Services

5.6.2.3 Service results

CertificateIssuerRevoked See Table 178 for the description of this result code. Bad_RequestTypeInvalid The SecurityToken request type is not valid. Bad_SecurityModeRejected The security mode does not meet the requirements
OPC-10000-4 – OPC Unified Architecture - Part 4: Services

6.1.4 Creating a SecureChannel

Service with list returned in the CreateSession response . The exact mechanisms for using the SecurityToken to sign and encrypt Messages exchanged over the SecureChannel are described
OPC-10000-4 – OPC Unified Architecture - Part 4: Services

6.1.7 Continuous security checks

rejected on Client or Server side. ApplicationInstanceCertificates verification shall be executed every time the SecurityToken is renewed for a SecureChannel . OPC UA Applications may do additional verifications between SecurityToken renews
OPC-10000-4 – OPC Unified Architecture - Part 4: Services

7.40.6 IssuedIdentityToken

IssuedIdentityToken The IssuedIdentityToken is used to pass SecurityToken s issued by an external Authorization Service to the Server . These tokens may be text or binary. OAuth2 defines a standard
OPC-10000-6 – OPC Unified Architecture - Part 6: Mappings

6.7.2.3 Security Header

bytes. Name Data Type Description TokenId UInt32 A unique identifier for the SecureChannel SecurityToken used to secure the Message . This identifier is returned by the Server in an OpenSecureChannel response
OPC-10000-6 – OPC Unified Architecture - Part 6: Mappings

6.7.2.4 Sequence Header

same identifier. A SequenceNumber shall not be reused for any TokenId . The SecurityToken lifetime shall be short enough to ensure that this never happens; however, if it does the receiver
OPC-10000-6 – OPC Unified Architecture - Part 6: Mappings

6.7.4 Establishing a SecureChannel

UInt32 RequestType SecurityTokenRequestType SecurityMode MessageSecurityMode ClientNonce ByteString RequestedLifetime UInt32 Response ResponseHeader ResponseHeader ServerProtocolVersion UInt32 SecurityToken ChannelSecurityToken SecureChannelId UInt32 TokenId UInt32 CreatedAt DateTime RevisedLifetime UInt32 ServerNonce ByteString The ClientProtocolVersion and ServerProtocolVersion ... specified by the Client . The RevisedLifetime tells the Client when it shall renew the SecurityToken by sending another OpenSecureChannel request. The Client shall continue to accept the old SecurityToken until
OPC-10000-6 – OPC Unified Architecture - Part 6: Mappings

6.7.7 Verifying Message Security

closed the Client shall attempt to re-open the channel and request a new SecurityToken by sending an OpenSecureChannel request. The mechanism for sending transport errors to the Client depends ... SecureChannel TokenUnknown e rror shall be reported if the TokenId refers to a SecurityToken that has expired or is not recognized. If decryption or signature validation fails, then
OPC-10000-6 – OPC Unified Architecture - Part 6: Mappings

7.1.5 Error handling

processing the request. Bad_SecureChannelClosed The secure channel has been closed. Bad_SecureChannelTokenUnknown The SecurityToken has expired or is not recognized. Bad_CertificateUntrusted The sender Certificate is not trusted