## 4 Experiment and Analysis  
To evaluate the performance of the secure communication model we proposed in Chapter 3, we construct an experimental environment. As depicted in Figure 4, this experimental environment contains a server, a client and a CA. We adopt opcsvrda2 to build the server. Opcsvrda2 is a software development kit based on Win32 platform, it can meet the demand of OPC DA 1.0/2.0/3.0 specification and can develop an OPC server fast. Besides, we develop an OPC client using Visual Studio 2008. In this client we can configure the data volume transmitted and the security profile we want to use. There are five security profiles we can use in total, they are: none, WhirlpoolRSA, SHA1 RSA, basic128 rsa15 and basic256. The program interface of client configuration is shown in Figure 5. Finally, we construct a CA using OpenSSL to issue certifications to the client and server. In our experiment, the client constructs a secure connection with the server and read different lengths of data from the server. When a client requests the information for reading or monitoring, the server always returns a StatusCode which contains a ServerTimestamp and a SourceTimestamp. From these timestamps we can calculate the delay time brought by our model, and in turn we can obtain the time passed during data transmission after taking security measures and evaluate the effect these security profiles bring to data transmission. In this experiment, we select four kinds of length to perform the experiment: 1024 bytes, 4096 bytes, 8192 bytes and 16,384 bytes. The experiment is done 12,000 times for each security profile and each length of message. Figure 6 shows the delay time of the five security  
Figure 5: Program interface of client configuration. profiles when transiting messages in four kinds of lengths. In this set of figures the x-axis presents the chronological order of messages in a measurement and the y-axis represents delay time in milliseconds. In the legend of Figure 6, none means there is no secure measure taken; WhirlpoolRSA represents security profile using Whirlpool and RSA; SHA1 RSA means security profile using SHA-1 and RSA; basic128 rsa15 means security profile using AES-128, SHA-1 and RSA; and basic256 is security profile utilizing AES-256, SHA-1 and RSA. From this set of figures we can see that the delay time of basic128 rsa15 and basic256 are much longer than WhirlpoolRSA and SHA1 RSA. This means that WhirlpoolRSA and SHA1 RSA perform much better than the security profiles adopted in OPC UA security model in term of efficiency. Besides, the minimum delay time of the security profile using SHA-1 and RSA is longer than that using Whirlpool and RSA for integrity and authentication. It should be noted that as the network situation is occasionally  
Figure 6: Comparison of delay time in different lengths of messages. (**a**) In the length of 1024 bytes; (**b**) In the length of 4096 bytes; (**c**) In the length of 8192 bytes; (**d**) In the length of 16,384 bytes. not very stable, the delay time of transmission in the same security profile is slightly different. Table 1 shows the average delay time of each security profile in different length of data. From this table we can also find that basic128 rsa15 and basic256 cost a much longer delay time than WhirlpoolRSA and SHA1 RSA, and when the data volume transmitted is 8192 bytes, the delay time caused by using basic128 rsa15 and basic256 are all longer than 5 ms, such a delay is not acceptable for some industrial control systems like power systems. By contrast, WhirlpoolRSA and SHA1 RSA cost less than this specified value even the data volume transmitted is 16,384 bytes, thus these two profiles can be adopted in such systems. In addition, the security profile using Whirlpool and RSA has a smaller average delay time compared to the security profile using SHA-1 and RSA: the difference of delay time between these two profiles is approximately 4%-6%.