Enhancing Authorization Mechanisms using Attribute Certificates for OPC UA based Applications In the context of Industrie 4.0, integrity of data is considered as the core of networking and digitalisation. Endtoend security of the communicating entities within and across organizational boundaries is enabled by authentication and authorization methods. In order to ensure authorized access or modification to data, an access control system is used. Such an access control system based on the role of an entity is a Role Based Access Control (RBAC) system. In case of distributed networks, the authorization permissions of the communicating entities is determined both within and across organizational boundaries. For example, each organization defines the authorization permissions for each of its resources for both internal and external access. In case of external access, an organization can determine permissions based on a role assigned to an external entity trying to communicate across its organizational boundaries. Here, trusted association between the role and the identities need to be determined. Thus, the roleroles assigned to the external entity can be determined using an Attribute Certificate (AC). An AC contains the attributeattributes that determines the characteristics associated with an entity. An Attribute Authority (AA) of an organization that assigns a role attribute to the AC of an entity, issues each AC. Such an AA is created and managed using Public Key Infrastructure (PKI). The OPC UA (Open Platform Communication Unified Architecture) framework has different options for user authentication and one of the options is using X509IdentityToken. Integrating ACs in order to enhance authorization mechanism in the context of Industrie 4.0 is considered in this work. A multilevel PKI is designed in order to demonstrate the feasibility of the approach through a proof of concept implementation that establishes endtoend secure communication between OPC UA based applications. The advantages and challenges in creating such an infrastructure and further areas of research are discussed briefly.

An administrative model for UCON ABC UCON is an emerging access control framework that lacks an administration model. In this paper we define the problem of administration and propose a novel administrative model. At the core of this model is the concept of attribute, which is also the central component of UCON. In our model, attributes are created by the assertions of subjects, which ascribe propertiesrights to other subjects or objects. Through such a treatment of attributes, administration capabilities can be delegated from one subject to another and as a consequence UCON is improved in three aspects. First, immutable attributes that are currently considered as external to the model can be incorporated and thereby treated as mutable at tributes. Second, the current arbitrary categorisation of users (as modifiers of attributes), to system and administrator can be removed. Attributes and objects are only modifiable by those who possess administration capability over them. Third, the delegation of administration over objects and properties that is not currently expressible in UCON is made possible.