OPC UA

What is OPC UA?

OPC UA, the OPC Unified Architecture, is the communication standard that connects machines, controllers, SCADA, MES and cloud systems in industrial environments. The OPC Foundation specifies it in the OPC 10000 series, and it is standardised as IEC 62541. It is service-oriented and platform-independent: servers expose an address space of nodes that describe the machine, its variables, methods and events, and clients browse, read, write, subscribe and call methods through defined services. Companion specifications add standard information models for machine tools, robots, packaging (PackML) and many other domains, which is why OPC UA is the backbone of most Industry 4.0 architectures.

Transport is the binary protocol opc.tcp on port 4840, HTTPS, or, for publish/subscribe, UDP multicast and MQTT (Part 14, OPC UA PubSub).

Where is it defined?

Part 2 of the specification defines the security model. Each application has an X.509 application instance certificate. Client and server open a secure channel under a security policy that names the algorithms (Basic256Sha256, Aes128_Sha256_RsaOaep and Aes256_Sha256_RsaPss are current; Basic128Rsa15 and Basic256 are deprecated; None disables protection) and a message security mode (None, Sign, SignAndEncrypt). On top of the channel a session authenticates the user with an anonymous, username and password, X.509 certificate or issued token. Part 4 defines the services, Part 6 the mappings, Part 7 the profiles that products are certified against, Part 12 discovery and the Global Discovery Server for certificate management, and Part 18 role-based security. The BSI’s security analyses of OPC UA (2016, updated 2022) examined the specification and reference implementations and confirmed the design while pointing to implementation and configuration risks.

What it means in practice

OPC UA gives integrators every tool needed for a secure installation, and most installations use few of them. Typical findings:

• SecurityPolicy None in production. Enabled “for commissioning” and never disabled, often next to an anonymous user token policy. Anyone on the network can browse the full address space and write to writable nodes.
• Trust everything. Servers configured to accept any client certificate automatically, which turns certificate authentication into a formality. The trust list is the actual access control list and is rarely managed.
• Default and shared certificates. Self-signed certificates with the vendor’s default subject, identical on every device of a product line, never rotated.
• Deprecated policies. Basic128Rsa15 and Basic256 left enabled for old clients.
• Credentials in the clear. Username and password tokens over an unencrypted channel when the user token policy does not enforce encryption.
• No authorisation per node. Every authenticated user can write every writable variable, including setpoints, because roles are not configured.
• Implementation bugs. Chunk handling, certificate parsing and session limits in server SDKs have produced crashes and bypasses; the version of the SDK inside a product matters.

In a test we enumerate endpoints and their policies, check the trust list handling with our own certificates, map the address space and the write permissions, and fuzz the server stack on bench units. Zyberum tests OPC UA servers and the products that embed them, for component manufacturers against IEC 62443-4-2 and for operators as part of OT penetration tests.

Common misunderstandings

OPC UA is secure by design, not secure by default: the vendor ships every policy, the integrator chooses. OPC UA PubSub over MQTT shifts the trust to the broker; its security has to be configured there. And a certified OPC UA stack says the protocol is implemented correctly against the profile, not that the product around it is secure.