HMI-30 Real-Time Data Tunneling over LAN, WAN and Internet (Without DCOM)

ICONICS Worldwide Customer Summit – September 2006

HMI-30Real-Time Data Tunneling over

LAN, WAN and Internet(Without DCOM)

Petr Balda, Rudolf Griessl, Michael HiefnerMike Hilligas, Zhi Wei Li, Pavel Tucek, Zdenek ZadakPetr Balda, Rudolf Griessl, Michael HiefnerMike Hilligas, Zhi Wei Li, Pavel Tucek, Zdenek Zadak

What is the Issue?What is the Issue?

Customers want to network OPC clients and servers running on different platforms, in different domains, and on completely separate networks…

OPC Tunneling – What is the Issue and Why?Dan Muller, , Product Development Dir.• The Real DCOM Issue…DataWorX32 OPC Tunneling – The Solution!DataWorX32 OPC Tunneling – Demonstration!The Quiz…

HMI-30 AgendaHMI-30 Agenda

In the BeginningIn the Beginning

Life Was Easy

GraphicsAlarmingTrending

……And we grew…And we grew…

Then someone else wanted to see…

……And grew…And grew…

Then everyone wanted to

see…

……And the Network ExpandedAnd the Network Expanded

People in Remote facilities wanted to see…

OtherBusiness Systems

……And Expanded…And Expanded…

The DCOMDCOM Nightmare…

OPC/IOServer(s)

Read Only Access

Read & Write Access

OtherBusiness Systems

The Real DCOM IssueThe Real DCOM Issue

Presented by

Dan MullerProduct Development DirectorCyberlogic

Why is DCOM an Issue?Why is DCOM an Issue?

DCOM and related security issues can prevent OPC communication from working.Latency of DCOM error reporting is unacceptable for real-time systems.

Dealing with DCOMDealing with DCOM

““Can’t I just set up the security Can’t I just set up the security settings within Windows?”settings within Windows?”

Yes – in theory. This can be done for small, simple

systems. For complex systems, this can be a

nightmare to administer.

The DCOM Problem…The DCOM Problem…

Accessing across domains and workgroups: domains must trust each other.

Some users may not have the privileges needed.

Requirements specific to different operating systems.

Firewalls. System-wide DCOM settings. Callbacks. Access, launch and activation

permissions.

Additional settings required for OPC servers.

Hard-coded security settings.

Coordinating with multiple IT administrators at different locations.

Maintenance as users, networks and systems change.

The latency of DCOM error reporting.

The DCOM Solution…The DCOM Solution…

OPC Unified Architecture (UA) should/will eliminate this problem in the future.

A tunneler product solves this problem today, by eliminating DCOM completely.

Why ICONICS?Why ICONICS?

Only a handful of companies make tunneling products.One company in Germany and another in Canada offer tunneler products that work with OPC DA only.One company in Tunisia offers one product for OPC DA and one product for OPC A&E.ICONICS DataWorX Tunneler product supports OPC DA, A&E and HDA.

ICONICS DataWorX ICONICS DataWorX Tunneler…Tunneler…

Let’s listen to ICONICS’s tunneling product capability with a demonstration, using a Cyberlogic OPC Server.

DataWorX V9 – The SolutionDataWorX V9 – The Solution

-Lite Version V9-Lite Version V9-Tunneler Kit (pair)-Tunneler Kit (pair)-Lite Version V9-Lite Version V9-Tunneler Kit (pair)-Tunneler Kit (pair)

-Standard -Standard V9V9-Standard -Standard V9V9

-Professional V9-Professional V9-Redundancy -Redundancy (pair)(pair)

DataWorX V9 – The SolutionDataWorX V9 – The Solution

So, Why is DCOM an Issue?So, Why is DCOM an Issue?

Complexity to Configure DCOMDCOM is Not Real-Time• DCOM can take up to 6 minutes to detect

and notify when a connection failure has occurred

DCOM is Not Firewall Friendly• Firewall pass through requires many open

ports• Major Security Issue

DataWorX32 - OPC DataWorX32 - OPC TunnelingTunneling

Bridges any OPC Server to any OPC ClientFirewall and Internet friendlySupports Tunneling of • OPC DA• OPC AE• OPC HDA

Alternative to conventional MS DCOM communications

OPC Tunneling ArchitectureOPC Tunneling Architecture

Based on ICONICS’ patented GenBroker™ communication – versus DCOMGraphical user interface provides centralized management of all remote connections

OPC Tunneling ArchitectureOPC Tunneling Architecture

OPC Tunneling Key OPC Tunneling Key FeaturesFeatures

Supports latest OPC Industry Standards• OPC Data Access 3.0• OPC Alarm and Events 1.1• OPC Historical Data Access 1.2Auto-discovery of remote OPC DA, A/E and HDA ServersSimple to set up and configureSupports OPC browser interfaces over LANs, WANs, and the Internet

Supports TCP/IP and SOAP/XML communication protocols

OPC Tunneling SecurityOPC Tunneling Security

Most Competitors Have None!Tunneling Client sends credentials to Server side of TunnelServer Side• Obtains authentication• Uses “impersonation” to create the

server under the specified user accountEach Tunneling connection can have it’s own credentials

OPC Tunneling SecurityOPC Tunneling Security

If the specified User does not have access rights to the destination OPC Server, then the OPC Tunnel creation fails and an “Access Denied” is reportedThe access is controlled by the DCOM Configurator at the remote location. (DCOM in Server, not across the Network)

DEMONSTRATION!!!DEMONSTRATION!!!

ICONICS WWCS Company ICONICS WWCS Company ArchitectureArchitecture

OPC Servers

Switches

OPC Servers

Wireless

Routers

The Internet

4 Simple Steps to Create a 4 Simple Steps to Create a Tunnel Tunnel

OpenClick on OPC Tunnel icon

Browse to DA, AE or

HDA server

Right click, select ‘Make OPC Tunnel’

That’s It !That’s It !

Bridges any OPC Server to any OPC ClientFirewall and Internet friendlySupports Tunneling of • OPC DA• OPC AE• OPC HDA

Alternative to conventional MS DCOM communications

DataWorX32 - ResourcesDataWorX32 - Resources

DataWorX32 OPC Tunneling.pdfDataWorX32_Prod_Bulletin.pdf

The QUIZ!!!

Thank You!!!

Petr Balda, Rudolf Griessl, Michael HiefnerMike Hilligas, Zhi Wei Li, Pavel Tucek, Zdenek ZadakPetr Balda, Rudolf Griessl, Michael HiefnerMike Hilligas, Zhi Wei Li, Pavel Tucek, Zdenek Zadak

HMI-30 Real-Time Data Tunneling over LAN, WAN and Internet (Without DCOM)

Documents

Unit 6 dcom

OpcCompetence F EN 180901 300 - ATEVA€¦ · Rockwell, B&R, etc. OPC Client OPC Server NoSQL / SQL Databases DCOM Applica on Sensor Controller Gateway SCADA HMI Trending Analy cs

DCOM And CORBA Comparison

DCOM - Secure by Default · connectivity is accomplished using Distributed COM (DCOM), which contains a Security Layer. DCOM Security is used to determine which users have Access

DCOM Configuration Guide - writetothepoint.orgwritetothepoint.org/writingsamples/developers/DCOMConfigurationGuide.pdfApr 20, 2010 · Configure the Operating Systems for DCOM Security

DCOM Technical Overview

Opc Dcom Security

DCOM-CORBA Comparison

HMI Hardware...Five HMI models HMI 4.3”, HMI 7” (Low Cost), HMI 7” (High Performance), HMI 10” & HMI 15” are available. 2.1.1 Technical Specifications Model HMI 4.3” HMI

DCOM Configuration Guide - OSIsoftcdn.osisoft.com/interfaces/3104/DCOM Configuration Guide_OPCHDAI… · DCOM Configuration Guide iii Table of Contents ... related documents, and

[MS-DCOM]: Distributed Component Object Model (DCOM ......Release: July 14, 2016 [MS-DCOM]: Distributed Component Object Model (DCOM) Remote Protocol Intellectual Property Rights Notice

Communication Skill Dcom

DCOM Configuration for KEPServerEX - opchub.comWarning: The following instructions for DCOM configuration allow for all access by all users for all DCOM components. If security is

DCOM SPO TIMES JAN

DCOM Technology. What is DCOM? DCOM is just COM with a longer wire DCOM is just COM with a longer wire DCOM extends COM to support communication among

[MS-DCOM]: Distributed Component Object Model (DCOM ......Distributed Component Object Model (DCOM) Remote ... The example companies, organizations, products, domain names, email addresses,

Using OPC via DCOM with Windows XP SP3 - … · Basic Settings 1 Configuring the firewall 2 Configuring DCOM 3 Configuring DCOM Machine Default 4 SIMATIC HMI Using OPC via DCOM with

Dcom visualC++

DCOM Configuration

DCOM Interface