Overview
IEC 62541-18:2025 - “OPC Unified Architecture - Part 18: Role-Based Security” defines an Information Model for modelling role-based security in OPC UA systems. The Part specifies the object and type model used by servers to represent Roles, RoleSets and related user-management concepts so that clients and configuration tools can manage authorization centrally. (Role-based security was previously in IEC 62541-5:2020, Annex F.)
Key topics and requirements
- Information Model for Roles: Defines types such as RoleSetType, RoleType, EndpointType, IdentityMappingRuleType and IdentityCriteriaType to represent roles, role membership rules and scope.
- Role management methods: Standardized operations like AddRole and RemoveRole for dynamic configuration of Roles in a RoleSet; roles are identified by unique BrowseNames within a RoleSet.
- Identity mapping: Mechanisms to map a client’s identity (user token and application identity) to Roles using identity mapping rules and criteria.
- Permissions vs. Authentication: Emphasizes separation of authentication (who a client is) from authorization (what the client is allowed to do). Permissions are assigned to Roles for AddressSpace Nodes (per IEC 62541-3).
- User management model: Defines UserManagementType, data structures and methods such as AddUser, ModifyUser, RemoveUser and ChangePassword to manage local user accounts and password options.
- Audit and events: Includes audit event types such as RoleMappingRuleChangedAuditEventType to track changes in role mappings for accountability.
- Conformance and modular implementation: Servers can implement parts or the whole model; model components are organized into conformance units and relate to other OPC UA Parts.
Practical applications
- Secure industrial automation systems by centralizing authorization logic in Roles while allowing multiple authentication mechanisms.
- Implement fine-grained access control to OPC UA AddressSpace nodes (read/write/execute) across devices, gateways and servers.
- Enable integrators and administrators to manage role lifecycle and mappings consistently across heterogeneous systems.
- Support audit trails for security changes in compliance-sensitive environments (SCADA, DCS, IIoT).
Who should use this standard
- OPC UA server and client developers implementing role-based access control.
- System integrators and automation engineers designing secure industrial networks.
- Security architects and administrators responsible for user and role lifecycle management in manufacturing and industrial IoT ecosystems.
Related standards
- IEC 62541-1, -3, -4, -5, -6, -8, -12 (OPC UA framework, Address Space, Services, Information Model, Mappings, Data Access, Discovery/Global Services) - referenced normative documents for complete implementation context.
Keywords: IEC 62541-18:2025, OPC UA, role-based security, Information Model, RoleSet, UserManagementType, identity mapping, permissions, industrial automation.
