Sensitive data security

AVEVA PI System Connector 3 (PSC3) protects sensitive data by securely managing client secrets through the PI Identity Models secret store and encrypting confidential information using the Microsoft Data Protection API (DPAPI). It also uses X.509 certificates to secure administrative access and communication channels, with private keys stored in the Windows Certificate Store.

Passwords

Passwords are no longer required to authenticate with the data sources. We utilize the PI Identity Models secret store (using Microsoft Data Protection API (DPAPI)) to keep client secret for OIDC authentication.

• Client.config is stored in the %PIHOME64%\PI System Connector 3\Configuration\Client folder.

• Broker.config is stored at %PIHOME64%\PI System Connector 3\Configuration\Broker folder.

  Note: The Microsoft Data Protection API (DPAPI) is used to perform encryption for connectors that encrypt confidential information such as passwords.

Cryptographic keys

Connectors create two X.509 certificates at installation time for each connector application (connector, PI Connector Relay, and PI Data Collection Manager). The first X.509 certificate is used to secure an HTTPS connection used for application administration. The second X.509 certificate is used to secure AMQPS communication. The private keys for these certificates are stored in the Windows Certificate Store.