Question:
I am a regular OPC user and have connected my DCS via an OPC Server to OPC Client applications on both the process control network and on the office network. The connectivity works fine but many of these data points are used for critical control. What options do I have to limit the client users who have access to my DCS?
Answer:This concern is most valid. The security permissions for communication between OPC Client and Servers relies on your Windows security model and therefore invokes an "all-or-nothing" permission ideology. When you use the Microsoft DCOM configuration tool to grant your OPC Clients access to the OPC Server information, you are effectually allowing this Client tool full control of your system. Hardware settings or OPC Server item aliasing usually provide some means to configure points as read-only but what would you do to enable some process layer clients to have write control, but business layer clients to have only read control of the same data points?
OPC DataManager (ODM) is a highly versatile read/write OPC Client. Though its basic functionality is to provide point-to-point mappings of OPC Server items, many users have implemented ODM in their control systems to solve this very problem. Using Windows security to allow ODM full local permissions while you deny remote OPC Client permission to your DCS OPC Server(s) provides a highly effective security shield for your control system. Instead of your various remote OPC Clients "pulling" information from the DCS OPC Server(s) across the network, you can use ODM to "push" only the data you choose to one or more remote OPC Caching servers. The local OPC Client permissions on one of these Caching servers as compared to another would provide you the security flexibility of configuring which data points are broadcasted as read-only, and which can be controlled as read/write. If existing security policies in your company necessitate firewalls or there is no inherent trust relationships set up between these networks, ODM can be combined with OPC Tunnelling technology to enable reliable and secure OPC data connectivity throughout your process and office IT networks.
Do you have a
question for our OPC Solutions Architects?
Ask the
experts... 
The
2nd Annual MatrikonOPC Conference is being held in Houston in
September, and Germany in October. It will attract industry experts,
integrators, and process/discrete manufacturers globally.