As4.12下配置ansl加密通讯 | Configure ANSL encrypted communication under AS4.12

Ask Questions B&R Software & Runtime
1

现在我有一个需求，为了保证通信绝对安全，现在需要对ANSL进行加密通信。但查不到ANSL的加密通讯的配置方法，只查看TLS1.2可以用于ANSL，大家有具体的ANSL

加密通讯的配置步骤吗？

我现在用的AS 是4.12版本，AR是 J4.93版本。

2

Hi,

yes this is right, the encryption method for ANSL in AS4.12 is TLS 1.2 Certifiate-based encryption, there’s nothing else.
TLS 1.3 is only available in AS6.

I don’t understand exactly what you mean with “Everyone has specific ANSL settings”?

If you mean that every programmer should have a own certificate, that’s not possible as I know. All developers accessing ANSL have to use the same SSL configuration.

If you you mean that accessing ANSL should be additionally secured by Username + Password, that’s possible by using the PLCs role-based access modell:

If you want to know how to setup and use TLS encryption in AS4, you can have a look here:

Best regards!

3

Thank you for your answer, this part of the knowledge is indeed helpful. Additionally, I have another question:
My understanding is that the link you sent enables monitoring between AS software and controllers in Ansl encrypted state. So, what configurations are needed between two controllers that require ANSL communication?
For example, I have two controllers, one is 0484 and the other is C50. I have written an ansl communication program in 0484 to actively read and write variables in C50. So, in which controller do I need to create certificates and configure SSL, and what configurations do I need to make in the other controller to ensure proper communication between the two?

Best regards！

4

Hi,

I don’t have practical experience with it, but Controller-to-Controller communication with ANSL is made by the AsANSL library.

From the online help, it looks like that both possibilities (encryption and authentication) are supported by AsANSL via associated parameters inside the configuration object on the ANSL client side.

So I think:

  • both PLCs need the certificate based TLS setup, so that they can communicate via ANSL encrypted.
  • the client PLC (the one who’s calling the AsANSL library) needs the right setup information in the AsANSL configuration data module (parameters SSLConfig and EnableSSL in the data module).
  • in both PLCs, the use of unencrypted ANSL has to be switched off.

Just as side-note: a encrypted data communication between 2 PLCs would also be possible by OPCUA (one PLC acting as server, rhe other as client). Using OPCUA, the client can only access the datapoints on the server that are configured for being accessed.

Best regards!