HTTP digest authentication in embedded automation systems

In automation systems, embedded web servers are often used for human machine interface (HMI) functionalities. Using the TCP/IP stack as communication protocol suite opens new opportunities to access the embedded web server. Therefore, an embedded web-server based HMI is very suitable for remote services as configuring, monitoring and control. However, a remote access requires security procedures. A security protocol that is able to deal with the limited resources of an embedded web server is HTTP (hypertext transfer protocol) digest access authentication (DAA). It provides a secure challenge/response mechanism for user authentication. Apart from this, its definition has foreseen other features which are not implemented in currently available servers, but could be very valuable to extend the application range of DAA. This paper outlines the general functionality of digest authentication defined by its RFC and investigates the most widely distributed implementations on server and browser side. The results of functionality and interoperability tests are presented.