OPC UA Security Modes and Policies: A Safe Setup for OEE

Key takeaways

• Use the SignAndEncrypt mode for every OEE connection, and switch off None.
• Pick a current security policy, and turn off the old ones the OPC Foundation has retired.
• Trust certificates on both sides: the server trusts the gateway, the gateway trusts the server.
• Give the OEE gateway its own user with read-only rights. No anonymous access.
• Track certificate expiry dates, because an expired certificate stops the data.

OPC UA can be very secure, but only if it is set up that way. Many servers ship with an open endpoint for commissioning. For OEE, keep one endpoint: signed and encrypted, with trusted certificates and a read-only user for the gateway.

Fabrico, OEE and light MES software with AI cameras, reads machine data through PLCs, IoT devices or cameras. Security settings for each plant's connection are agreed with Fabrico's technical team. This guide covers the vendor-neutral OPC UA side.

What does OPC UA security protect?

OPC UA, also known as IEC 62541, builds security into the protocol. It covers three things:

• Authentication: the server and the client prove who they are.
• Integrity: nobody can change a message on the way without it being noticed.
• Confidentiality: nobody on the network can read the message.

The server offers one or more endpoints, and each endpoint has a security mode and a security policy. The client connects to the endpoint it is allowed to use. Our OPC UA guide covers the base standard.

What are the OPC UA security modes?

The security policy sets the algorithms behind the mode. Current policies include Basic256Sha256, Aes128_Sha256_RsaOaep and Aes256_Sha256_RsaPss. The older Basic128Rsa15 and Basic256 policies are deprecated, so switch them off too.

How do certificates work in OPC UA?

Each OPC UA application, the PLC's server and the OEE gateway's client, has its own application certificate. A secure connection only works when each side trusts the other's certificate.

1. The gateway presents its certificate to the server.
2. The server's administrator moves it to the trusted list, once, after checking it.
3. The gateway trusts the server's certificate in the same way.
4. Both sides note the expiry date, and renew before it.

Certificates can be self-signed or signed by the plant's own certificate authority. With many machines, a plant authority saves work, because each side then trusts one issuer instead of each certificate.

Which user account should the OEE gateway use?

OPC UA also asks who the user is. The common user token types are anonymous, a user name with a password, and an X.509 certificate.

• Turn off anonymous access on the endpoints the gateway uses.
• Create one user for the OEE gateway, such as oee_reader, with a strong password or a user certificate.
• Give it read-only rights on the nodes OEE needs. It never needs to write.
• Keep it separate from engineering and HMI accounts, so it can be removed without side effects.

Worked example: securing six PLC servers

Sample line (illustrative numbers, not a customer). A line has six PLCs, each with an OPC UA server. Each server shipped with three endpoints.

That is 6 x 2 = 12 endpoints switched off and 12 trust entries to set up once. With a plant certificate authority, the trust work drops to one issuer on each side.

The settings take a short session per PLC with the controls engineer. Write them down, together with each certificate's expiry date, so the next renewal is not a surprise.

What else should IT check?

• Network zones. Only the gateway should reach the PLC servers. Our guide to IEC 62443 zones and conduits shows how.
• Outbound only. The gateway sends data out; nothing connects in from the internet.
• The vendor's process. A software vendor is judged on IEC 62443 part 4-1, secure development, and part 4-2, component requirements.
• Logs. Failed connection attempts on the server should be visible to someone.

The cloud MES buyer's guide for IT adds questions on uptime and data ownership.

Which OPC UA security mistakes are most common?

• Leaving the None endpoint on after commissioning.
• Trusting every certificate automatically, which defeats the point of certificates.
• Allowing anonymous users because a tool was easier to set up that way.
• One shared password for every gateway in every plant.
• Forgetting expiry dates, so data stops one morning with no warning.

Where does Fabrico fit?

Fabrico is a computer vision enabled Manufacturing Performance Platform. OEE and light MES come first, read from the signals each machine offers.

• Automatic downtime logging from PLC tags, IoT devices or cameras.
• The operator confirms the reason in one tap, so stops carry a cause.
• OEE live by line and shift, with every loss priced in money.
• A pilot on one line, which gives IT a small scope to review first.

Fabrico makes no certification claim; security settings are agreed per plant with its technical team. There is no free plan and there are no tiers: each plant gets a quote. See the product on the computer vision OEE page, and the data side in OPC UA for OEE.

Frequently asked questions

What are the OPC UA security modes?

There are three: None, Sign and SignAndEncrypt. None protects nothing. Sign detects any change to a message but does not hide it. SignAndEncrypt both detects changes and hides the content. For an OEE connection, use SignAndEncrypt and switch off None.

What is an OPC UA security policy?

It is the set of algorithms an endpoint uses for signing and encryption. Current policies include Basic256Sha256, Aes128_Sha256_RsaOaep and Aes256_Sha256_RsaPss. The older Basic128Rsa15 and Basic256 are deprecated and should be turned off.

Should anonymous access be allowed for OEE?

No. Give the OEE gateway its own user, with a strong password or a user certificate, and read-only rights on the nodes it needs. Then the plant knows exactly which system reads the PLC, and can remove that access without touching anything else.

How are OPC UA certificates trusted?

Each side keeps a list of trusted certificates. An administrator checks the other side's certificate once and moves it to that list. A plant certificate authority makes this simpler, because each application then trusts one issuer instead of every single certificate.

Does encryption slow down OEE data?

Not in a way OEE notices. OEE reads a few values per machine at modest rates, which is light work even with encryption. If the PLC is old or busy, ask your controls engineer to check the load, and read only the values you need.

Review your OPC UA setup with us

Bring your OPC UA server settings for one machine. We will show what a secure OEE connection needs and what its stops cost.

Request a demo · Contact us