Accessing data on a Simatic S7-1200/1500 using Python

Accessing data securely by configuring the integrated OPC UA Server

read in your web browser

www.spektrum-engineering.de Spektrum Engineering 1
TOC

1. Enabling and setting up OPC UA in TIA Project

a) Setting up security mechanisms based on X.509 certificates to enable authentication and encryption in TIA Portal

b) Setting up general PLC security mechanisms

2. Installing python-opcua and opcua-client using pip (on Windows)

a) Install clients and test installation

b) Create client certificate in TIA Portal for Python client

3. Accessing data on the SIMATIC S7-1200/S7-1500

www.spektrum-engineering.de Spektrum Engineering 2

PLC Configuration in TIA Portal

www.spektrum-engineering.de Spektrum Engineering 3

 Network Topology

TCP/IP Ethernet

OPC UA Client (Python): OPC UA Server:

IP Adresse: xxx.xxx.xxx.xxx IP Adresse: xxx.xxx.xxx.xxx

www.spektrum-engineering.de Spektrum Engineering 4

Enable OPC UA Server in TIA Project

Purchase OPC UA License from

Siemens Industry Mall and
activate it in your TIA project

www.spektrum-engineering.de Spektrum Engineering 5

Enable OPC UA Server in TIA Project

Activate OPC UA Server for

selected PLC in Device
Configuration.
Make sure to follow security
setup instructions on the
following slides to avoid
unrestricted OPC UA access!

www.spektrum-engineering.de Spektrum Engineering 6

Enable OPC UA Server in TIA Project

…user management via project

security settings is available only
in case the entire project is
protected!

→ protect your TIA project

www.spektrum-engineering.de Spektrum Engineering 7

Setting up OPC UA security mechanisms

Protect entire project to enable advanced

security mechanisms such as:
- project-wide user administration
- project-wide certificate manager

Defining project-wide security settings has the advantage,

that you can administer security settings globally for
multiple PLCs in your project.
In addition, when accessing your PLCs remotely using OPC
UA, it is more comfortable/securer to maintain your
certificates and users project-wide for all PLCs instead of
individually for every single PLC.

www.spektrum-engineering.de Spektrum Engineering 8

 Setting up OPC UA security mechanisms
Mutual Authentication

TCP/IP Ethernet

OPC UA Client (Python): OPC UA Server:

IP Adresse: xxx.xxx.xxx.xxx IP Adresse: xxx.xxx.xxx.xxx

www.spektrum-engineering.de Spektrum Engineering 9

Client presents its certificate to Server needs to „know“ the client‘s certificate and has to
server have it marked as „trusted“ to accept the connection request.

TCP/IP Ethernet

Client needs to „know“ the server‘s certificate and has to have it Server presents its certificate to
marked as „trusted“ to accept the connection request. the server.
Setting up OPC UA security mechanisms

Enable project wide certificate manager for

selected PLC
→ All PLC-specific certificates will be lost!
(may cause trouble with OPC UA clients if your PLCs are currently used
in existing environments)

www.spektrum-engineering.de Spektrum Engineering 12

Setting up OPC UA security mechanisms
Server Certificate

In the PLC specific certificate manager create a new

certificate for the OPC Server!
(This creates a key pair)

For the Certificate Authority (CA) select one of the

suggested above (alternatively import your CA in the global
certificate manager, which is not part of this slide deck)

www.spektrum-engineering.de Spektrum Engineering 13

Setting up OPC UA security mechanisms
Server Certificate

Device specific certificate manager,

showing recently created certificate

→ Same certificate will be shown in

project wide certificate manager

www.spektrum-engineering.de Spektrum Engineering 14

Setting up OPC UA security mechanisms
Server Certificate

Global certificate manager showing

recently generated certificate

www.spektrum-engineering.de Spektrum Engineering 15

Setting up OPC UA security mechanisms
Server Certificate

Add created certificate to OPC UA server

settings

www.spektrum-engineering.de Spektrum Engineering 16

Setting up OPC UA security mechanisms
Server Certificate

Configure supported authentication and

encryption schemes the PLC should
support!
Disable “No security” to enforce
cryptographic client authentication and
encrypted communication!

www.spektrum-engineering.de Spektrum Engineering 17

Setting up OPC UA security mechanisms

Disable “Enable guest authentication” to

avoid anonymous access by anyone
without username and password!

Enable “Enable username and password

authentication”, define a username and
password which will be granted access to
the OPC UA Server

www.spektrum-engineering.de Spektrum Engineering 18

Setting up general PLC security mechanisms

Using OPC UA server means connecting

the PLC to a network at the same time.
Therefore, disable unprotected access to
the PLC in any case by disabling
anonymous access without username and
password. Especially for Online Access,
Programming Access and for HMI Access,
as well!

www.spektrum-engineering.de Spektrum Engineering 19

Setting up general PLC security mechanisms

Set a password for your PLC display when

“Enable write access” is activated (S7-
1500)!

www.spektrum-engineering.de Spektrum Engineering 20

 Installing OPC UA Python client

www.spektrum-engineering.de Spektrum Engineering 21

 Installing OPC UA Python library into a virtualenv

Create a python virtualenv and install opcua, opcua-client and PyQt5 into using pip:
• pip install opcua opcua-client PyQt5
opcua – client library – https://github.com/FreeOpcUa/python-opcua
opcua-client – demo application – https://github.com/FreeOpcUa/opcua-client-gui
PyQt5 – GUI framework required by opcua-client – https://pypi.org/project/PyQt5/

www.spektrum-engineering.de Spektrum Engineering 22

 Installing OPC UA Python library into a virtualenv

Install optional libraries to support cryptographic schemes which we have set up in TIA project:
pip install crypto cryptography

www.spektrum-engineering.de Spektrum Engineering 23

 Installing OPC UA Python library into a virtualenv

Install optional libraries to get full benefit using the opcua-client application
pip install pyqtgraph numpy

www.spektrum-engineering.de Spektrum Engineering 24

 Installing OPC UA Python library into a virtualenv

Test your installation by starting the demo application from within your virtualenv: opcua-client

www.spektrum-engineering.de Spektrum Engineering 25

Create client certificate for Python in TIA Portal

Create second certificate for

client (this creates a key pair)
Use same CA for server and
client certificate!

In the field Subject Alternative Name, set

the string as seen on the left. This is
required by the OPC UA Python client
library which we will use later in the
project!

www.spektrum-engineering.de Spektrum Engineering 26

Create client certificate for Python in TIA Portal

In the global certificate manager, the newly

created client certificate is shown. Export the
certificate (in der format – seen on this slide)
and the belonging private key (in pem format –
seen on next slide). Export by secondary-click
on the certificate. This key-pair will be used to
authenticate the client to the server.

www.spektrum-engineering.de Spektrum Engineering 27

Create client certificate for Python in TIA Portal

Now export the private key and include the

certificate chain. We will be using this certificate
in our client application – which might run
unattended – therefore we will not protect the
private key with a password!

www.spektrum-engineering.de Spektrum Engineering 28

Limit access to clients on PLC

The PLC permits access to clients which provide

the recently created client certificate.

Add this certificate to the PLC “Trusted clients”

and disable “Automatically accept client
certificates during runtime” to prevent clients
from connecting which do not present a proper
certificate to the PLC.

Download the project to the PLC and set it to

Run Mode.

www.spektrum-engineering.de Spektrum Engineering 29

Connect to PLC using Python Client Library

Start the OPC UA Python client as described before.

In the address field type the URL in the following
format:
opc.tcp://<username>:<password>@<ip-address>:<port>
For example:
opc.tcp://OPCUser01:11223344Ki@192.168.1.232:4840

Click on “Connect options” and then on “Query

server capability” to get recommended connection
properties.

Set your client certificate and client private key!

www.spektrum-engineering.de Spektrum Engineering 30

Connect to PLC using Python Client Library

Close the “Connection Dialog” and click on

“Connect”.

You’ll be presented with the OPC UA XML tree

served by your SIMATIC PLC!

You can read/write only these variables/tags you

have granted access to in TIA portal!

www.spektrum-engineering.de Spektrum Engineering 31

 Browse data blocks on PLC

You can access only the variables/tags you have allowed access to in TIA portal!

www.spektrum-engineering.de Spektrum Engineering 32

Spektrum Ingenieurgesellschaft mbH read in your web browser

Web: https://siincos-remote-connect.de

Mail: siincos@spektrum-engineering.de

linkedin.com/company/siincos/

instagram.com/spektrum.engineering/

www.spektrum-engineering.de Spektrum Engineering 33