How OPCNet Broker® secures the OPC links between the OPC servers at each plant and a local data collection application, which forwards the data to a central historian or database, with encryption, authentication and tag-level access control.
Organizations that operate several plants, production facilities or remote sites need a consolidated view of their operations. That means bringing data from many OPC (Open Platform Communications) servers into a central historian, database, monitoring platform or enterprise application.
This use case shows how OPCNet Broker® DA HDA AE provides a consistent, secure way to collect OPC data across sites as the number of facilities grows.
Each site may host several OPC servers, and the central system needs access to data from all of them. Establishing and maintaining DCOM (Distributed Component Object Model) based connections across multiple network boundaries becomes harder with every new site.
Firewall policies, network configurations and local security requirements also differ from one site to another, which complicates the architecture and its administration.
The organization needed an approach that would:
OPCNet Broker® provides communication tunnels between the OPC servers at each site and the site's data collection layer.
At each site, the OPCNet Broker® Server Side connects to the local OPC servers in the process control network (PCN). The OPCNet Broker® Client Side runs in the site DMZ (demilitarized zone), next to a local OPC client or data collection application that retrieves the required data through the tunnel and forwards it to the central historian, database or enterprise system.
Data in transit is protected by encryption and user authentication, and the Tag Security add-on module restricts access down to individual tags. Organizations can therefore consolidate data from multiple sites without relying on DCOM across any network boundary.
Figure 1: Multi-site OPC data collection through OPCNet Broker® tunnels into a central historian
A mining company operates several processing plants, each with multiple OPC servers providing data from production equipment and control systems.
At each plant, OPCNet Broker® tunnels connect the OPC servers in the process control network to a data collection application in the plant DMZ. That application stores the data in a common historian or database at corporate level.
The company can then compare and consolidate information across its facilities to support enterprise-wide monitoring and operational analysis.
Consolidate industrial data from multiple facilities into a common destination.
Extend the architecture as new sites and OPC servers are added.
Encryption and user authentication in transit, with tag-level access control through the Tag Security add-on module.
One tunneling approach across all sites and network environments, making distributed OPC connections easier to manage.
Plant data available for centralized monitoring, reporting, analysis and decision-making.
A tunnel alone does not make an OPC deployment secure. In production, enable encryption and user authentication on the OPCNet Broker® tunnel, restrict the configured TCP port to approved hosts, use application whitelisting, and harden the machines hosting OPCNet Broker® and the OPC applications. The full checklist is available in the use case "Sharing Custody Transfer Metering Data Between Organizations Without Connecting Their OT Networks".
Talk to an Integration Objects expert about your use case, or request a technical assessment of your OPC architecture.
OPC TunnelingHow OPCNet Broker® lets OPC clients in an industrial DMZ reach OPC servers in the OT network by opening one TCP port, instead of the multiple dynamic ports DCOM requires.
OPC TunnelingHow OPCNet Broker replaces DCOM-based OPC Classic connections inside a single plant network with one encrypted tunnel, making OPC links simpler to deploy, secure and troubleshoot.
OPC TunnelingHow producers, pipeline operators and downstream operators exchange custody transfer metering data DMZ to DMZ with OPCNet Broker® and OPC Data Transfer, without connecting their process control networks.