IEC 62541-18:2025

Overview

IEC 62541-18:2025 - “OPC Unified Architecture - Part 18: Role-Based Security” defines an Information Model for modelling role-based security in OPC UA systems. The Part specifies the object and type model used by servers to represent Roles, RoleSets and related user-management concepts so that clients and configuration tools can manage authorization centrally. (Role-based security was previously in IEC 62541-5:2020, Annex F.)

Key topics and requirements

• Information Model for Roles: Defines types such as RoleSetType, RoleType, EndpointType, IdentityMappingRuleType and IdentityCriteriaType to represent roles, role membership rules and scope.
• Role management methods: Standardized operations like AddRole and RemoveRole for dynamic configuration of Roles in a RoleSet; roles are identified by unique BrowseNames within a RoleSet.
• Identity mapping: Mechanisms to map a client’s identity (user token and application identity) to Roles using identity mapping rules and criteria.
• Permissions vs. Authentication: Emphasizes separation of authentication (who a client is) from authorization (what the client is allowed to do). Permissions are assigned to Roles for AddressSpace Nodes (per IEC 62541-3).
• User management model: Defines UserManagementType, data structures and methods such as AddUser, ModifyUser, RemoveUser and ChangePassword to manage local user accounts and password options.
• Audit and events: Includes audit event types such as RoleMappingRuleChangedAuditEventType to track changes in role mappings for accountability.
• Conformance and modular implementation: Servers can implement parts or the whole model; model components are organized into conformance units and relate to other OPC UA Parts.

Practical applications

• Secure industrial automation systems by centralizing authorization logic in Roles while allowing multiple authentication mechanisms.
• Implement fine-grained access control to OPC UA AddressSpace nodes (read/write/execute) across devices, gateways and servers.
• Enable integrators and administrators to manage role lifecycle and mappings consistently across heterogeneous systems.
• Support audit trails for security changes in compliance-sensitive environments (SCADA, DCS, IIoT).

Who should use this standard

• OPC UA server and client developers implementing role-based access control.
• System integrators and automation engineers designing secure industrial networks.
• Security architects and administrators responsible for user and role lifecycle management in manufacturing and industrial IoT ecosystems.

Related standards

• IEC 62541-1, -3, -4, -5, -6, -8, -12 (OPC UA framework, Address Space, Services, Information Model, Mappings, Data Access, Discovery/Global Services) - referenced normative documents for complete implementation context.

Keywords: IEC 62541-18:2025, OPC UA, role-based security, Information Model, RoleSet, UserManagementType, identity mapping, permissions, industrial automation.