Client/server system for communicating according to the standard protocol OPC UA and having single sign-on mechanisms for authenticating, and method for performing single sign-on in such a system

• US 8,522,333 B2
• Filed: 08/17/2010
• Issued: 08/27/2013
• Est. Priority Date: 02/26/2008
• Status: Active Grant

• Current Assignee: ABB Schweiz AG (ABB Limited)
• Original Assignee: ABB Research Ltd. (ABB Ltd.)
• Inventors: Leitner, Stefan H.
• Primary Examiner(s): Vaughan, Michael R
• Application Number:
  US12/858,137
• Publication Number:
  US 20110035792A1
• Time in Patent Office: 1,106 Days
• Field of Search: None
• US Class Current: 726/8
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations

Abstract

A method and device are provided for integrating single sign-on (SSO) mechanisms in a client/server system using communication according to the standard protocol OPC UA, and for performing SSO for user authentication and authorization in the system. A client is connected to an aggregating server, and the aggregating server is connected to subordinated servers via a communication network. To integrate SSO mechanisms, the aggregating server is provided with an SSO component for mapping user legitimation data used in a service call to identities in the form in which the identities are stored in the subordinate servers. To perform SSO using the SSO component, user legitimation data associated with a service call are used to automatically search for corresponding mapped identities and affected servers, and to call up an active session service for each match in each server via the mapped identity, to establish the desired access to data from the user'"'"'s service invocation.

Claims

1. A method for integrating single sign-on (SSO) mechanisms in a client/server system with communication according to the OPC UA protocol and for performing SSO for user authentication in the system, wherein the system includes an OPC UA client which is connected to an OPC UA aggregating server, which in turn is connected to a plurality of subordinate OPC UA servers by means of a communication network, the method comprising:

providing, in order to integrate the SSO mechanisms, the OPC UA aggregating server with an SSO component for mapping user legitimation data, which are used in a service call, to identities in a form in which the identities are stored in the plurality of subordinate OPC UA servers; and

utilizing, in order to perform SSO with the aid of the SSO component, user legitimation data belonging to a service call to automatically look for corresponding mapped identities and for affected OPC UA servers and, for each match, to call an ActivateSession service in the respective OPC UA server using the mapped identity, after which the data access desired with the user'"'"'s service call is established.

2. The method as claimed in claim 1, comprising:

performing SSO on the basis of a service call originating from the OPC UA client, wherein the performing comprises;

setting up a secure channel and a session between the OPC UA client and the OPC UA aggregating server using standard services defined in a secure channel service set and a session service set;

providing the OPC UA aggregating server with user legitimation data using a standard ActivateSession service call defined in the session service set;

forwarding the service call and the user legitimation data to the SSO component; and

using, in the SSO component, the user legitimation data to look for matching stored mapped user identities and for affected OPC UA servers and, for each match, to call the ActivateSession service in the respective OPC UA server using the mapped identity.

3. The method as claimed in claim 1, comprising forwarding, by the OPC UA aggregating server:

an ActivateSession service call to the SSO component; and

other service calls for establishing a connection with the plurality of subordinate OPC UA servers to the identities stored in the plurality of subordinate OPC UA servers.

4. The method as claimed in claim 1, comprising:

setting up a secure channel between the OPC UA client and the OPC UA aggregating server using standard services defined in a secure channel service set;

setting up a session between the OPC UA client and the OPC UA aggregating server using session services defined in a session service set without forwarding calls to the session services to the OPC UA aggregating server, wherein an ActivateSession service call is not in the session service set;

calling standard services and session services of the plurality of subordinate OPC UA servers; and

in response to detecting an ActivateSession service call, forwarding the ActivateSession service call to the SSO component.

5. The method as claimed in claim 1, comprising setting up a secure channel and a session between the OPC UA client and the OPC UA aggregating server using standard services defined in a secure channel service set and a session service set;

in response to detecting a client attempt to access data, setting up, by the OPC UA aggregating server, a connection to a OPC UA server which contains the desired data; and

forwarding an ActivateSession service call to the SSO component.

6. The method as claimed in claim 1, comprising setting up a secure channel and a session between the OPC UA client and the OPC UA aggregating server using standard services defined in a secure channel service set and a session service set to establish a connection between the OPC UA client and the OPC UA aggregating server;

in response to detecting a first attempt by a client to access data, setting up, by the OPC UA aggregating server, a connection to a OPC UA server which contains the desired data;

terminating the connection to the OPC UA server when the connection between the OPC UA client and the OPC UA aggregating server is terminated by the OPC UA client or terminated on account of a time-out.

7. A client/server system which is set up for communication according to the OPC UA protocol and for single sign-on (SSO), the system comprising:

an OPC UA client;

an OPC UA aggregating server connected to the OPC UA client via a first communication network; and

a plurality of subordinate OPC UA servers connected to the OPC UA aggregating server via a second communication network,

wherein the OPC UA aggregating server comprises a SSO component configured to;

perform user authentication with SSO mechanisms;

map user legitimation data, which are used in a service call of a user, to identities in a form in which the identities are stored in the plurality of subordinate OPC UA servers; and

automatically look for corresponding mapped identities and for affected OPC UA servers using user legitimation data belonging to a service call and, for each match, to call an ActivateSession service in the respective OPC UA server using the mapped identity, after which the data access desired with the user'"'"'s service call is established.

8. The client/server system as claimed in claim 7, wherein the SSO component is configured to access stored information relating to all user identities available in the OPC UA servers and to map the identities to the identities used by users of the OPC UA client.

9. The client/server system as claimed in claim 8, wherein:

the OPC UA client and the OPC UA aggregating server are configured to provide the OPC UA aggregating server and the SSO component with the user legitimation data using a standard ActivateSession service call defined in a session service set.

10. The client/server system as claimed in claim 7, wherein:

the OPC UA client and the OPC UA aggregating server are configured to provide the OPC UA aggregating server and the SSO component with the user legitimation data using a standard ActivateSession service call defined in a session service set.

11. The client/server system as claimed in claim 7, wherein the first communication network connecting the OPC UA aggregating server and the OPC UA client is independent from the second communication network connecting the subordinate OPC UA servers and the OPC UA aggregating server.

12. The client/server system as claimed in claim 7, wherein the first communication network connecting the OPC UA aggregating server and the OPC UA client is part of the second communication network connecting the subordinate OPC UA servers and the OPC UA aggregating server.