Sensitive data security

AVEVA PI System Connector 3 (PSC3) protects sensitive data by securely managing client secrets through the PI Identity Models secret store and encrypting confidential information using the Microsoft Data Protection API (DPAPI). It also uses X.509 certificates to secure administrative access and communication channels, with private keys stored in the Windows Certificate Store.

PSC3 supports multiple authentication methods. The authentication requirements and sensitive data stored by PSC3 depend on the authentication method selected for each source and destination connection.

Authentication and credentials

PSC3 supports both Windows Authentication and OpenID Connect (OIDC) Authentication for connections to source and destination PI Data Archive and PI Asset Framework (AF) servers.

• Windows Authentication uses the Windows account that runs the connector or broker service. When Windows Authentication is selected, the account must have the required identity mappings and permissions on the source and destination PI Data Archive and PI AF servers.

• OIDC Authentication is optional and is used only when explicitly configured for a connection. When OIDC Authentication is selected, OIDC must be configured for the source and destination PI Data Archive and PI AF servers through AVEVA Identity Manager (AIM). This configuration requires a Client ID and Client Secret.

Credentials and authentication-related configuration data are stored securely and used only to establish authenticated connections between PSC3 and the configured PI systems.

Passwords

Passwords are no longer required to authenticate with the data sources. We utilize the PI Identity Models secret store (using Microsoft Data Protection API (DPAPI)) to keep client secret for OIDC authentication.

• Client.config is stored in the %PIHOME64%\PI System Connector 3\Configuration\Client folder.

• Broker.config is stored in the %PIHOME64%\PI System Connector 3\Configuration\Broker folder.

  Note: The Microsoft Data Protection API (DPAPI) is used to perform encryption for connectors that encrypt confidential information such as passwords.