Development of a monitoring system for encrypted data by OPC UA

Cyber-attacks on critical infrastructure have been on the rise. Therefore, cyber-security has become very important for Industrial Control Systems (ICS). For communication protocol in ICS networks, the Open Platform Communications Unified Architecture (OPC UA) communication protocol, which enables secure and platform-independent communications, is expected to be widely used. Beginning from OPC UA v1.04, which was released in 2021, Pub/Sub mode has been supported in addition to Client/Server. Because it can easily support much more communications than usual, it can support all use cases in the industrial sector. An important property of OPC UA is encryption. It is effective in protecting communication data from tampering and eavesdropping but also makes it impossible to monitor communications. In ICS, ill commands to controllers can cause dangerous situations. Even a secure communication protocol cannot guarantee that the data being communicated are safe. There are many types of machines, such as operating support systems and engineering workstations, that can send commands to controllers. They are implemented in common operating systems and may fall victim to a cyber-attack. Therefore, the commands to controllers should be monitored. We propose a monitoring system for encrypted data by OPC UA.