Secure Channel communication

This is an overview of the structure and implementation of Secure Channel TCP/IP communication.

Secure Channel Communication structure

The TCP/IP Secure Channel feature is used to provide more secure TCP/IP communication between a database, or AVEVA Historian, and a client application running on the same or another computer, with the Studio Database Gateway connecting the two.

The physical setup is:

• A database or AVEVA Historian is running on a computer.

• The gateway host computer (which is always a Windows computer) has Studio Database Gateway running, and it provides a client connection to the database/AVEVA Historian. The gateway host computer can be the same computer as the database/AVEVA Historian computer.

• The client computer has a client application running, and this client communicates with the Studio Database Gateway and through the Studio Database Gateway, the client application communicates with the database/AVEVA Historian. (The Studio Database Gateway acts as a server for the client application.) The client computer can be any of the following:

  • The client can be resident on the gateway host computer, which can also be the database/AVEVA Historian computer as mentioned above.

  • The client be on another Windows computer, running any Windows version of AVEVA Edge, connected to the gateway host computer through a TCP/IP connection.

The certificates that the Secure Channel script creates are used only between the project runtime and Studio Database Gateway. The connection between the gateway and AVEVA Historian uses a separate certificate that the Historian server provides. AVEVA Edge does not create or manage it. For more information, see Trust the AVEVA Historian server certificate.

The diagram below illustrates this setup:

Secure Channel Implementation

Setting up Secure Channel communication is a three-part process:

1. In the client application, enabling (checking) the Enable Secure Channel feature in any or all of the following database configuration dialogs:

   • Historian dialog for connecting to a Historian database located on-premises

   • In the Advanced Database Configuration dialog for the Trend worksheet, Trend Control object, and the Grid object.

   • In the Database Connection (Advanced) dialog for the Database/ERP worksheet.

2. In the gateway host, enabling the TCP/IP Secure Channel option in the Studio Database Gateway.

3. In both the gateway host and the client computer, run the script to create and import the certificates, next.