Skip to main content

OPC UA

The Corsha Gatekeeper provides MFA protection for OPC UA TCP connections in proxy mode deployments.

How Corsha Enhances OPC UA Security​

Standard OPC UA over TCP supports optional user authentication using static credentials such as:

  • Username/password pairs
  • X.509 v3 Certificates
  • JSON Web Tokens (JWTs)

Once stolen, these long-lived credentials allow unauthorized access for the entire credential lifetime, exposing industrial control systems to security breaches.

Corsha adds an additional factor of security, rendering stolen credentials useless. The Corsha Gatekeeper injects and validates short-lived, one-time-use MFA credentials directly into the OPC UA protocol handshake.

How It Works​

  1. Session Establishment: When an OPC UA client initiates a connection, it first connects to the Corsha Authenticator
  2. Credential Injection: The Authenticator obtains a short-lived MFA credential and embeds it into the OPC UA session handshake
  3. Connection to Gatekeeper: The authenticated OPC UA request is forwarded to the Corsha Gatekeeper protecting the OPC UA server
  4. Credential Validation: The Corsha Gatekeeper extracts and validates the MFA credential
  5. Server Access: Only requests with valid MFA credentials reach the protected OPC UA server

Without an unused, valid Corsha credential embedded in the OPC UA handshake, the connection is blocked by the Corsha Gatekeeper before reaching the server.

Key Features​

  • Client-Side Protection: Authenticators deployed alongside OPC UA clients inject credentials transparently
  • Server-Side Enforcement: Corsha Gatekeepers validate credentials before forwarding traffic
  • No Application Changes: OPC UA client and server applications require no modifications

Deployment Guides​

For step-by-step deployment instructions:

Configuration​

OPC UA support is configured in the Gatekeeper configuration file:

opcUaTcp:
  listenPort: 4840
  upstream:
    host: "opcua-server.local"
    port: 4840
    protocol: OPCUATCP

For complete configuration reference, see the Gatekeeper Docker Configuration Values or Helm Chart Values documentation.

Next Steps​

For information about other supported protocols, see Modbus TCP.