Machine Schema
Connect MCP

ODVA CIP Security

CIP Security is a cybersecurity extension for CIP and EtherNet/IP devices. It secures EtherNet/IP traffic by using TLS for TCP-based communications and DTLS for UDP-based transport class 0/1 communications, with device authentication via X.509 certificates or pre-shared keys and user authentication via OpenID Connect. It provides integrity, authenticity, and authorization for devices in critical-risk zones.

Source checked4/4 values · 2026-10-25

Specification

1 source
Transportstcp, udp
Architectureclient server
Encodingbinary
Standard bodyODVA

Study notes

  • CIP Security provides integrity, authenticity, and authorization for CIP and EtherNet/IP communications.
  • TLS (RFC 5246) is used for TCP-based communications, including the encapsulation layer, UCMM, and transport class 3.
  • DTLS (RFC 6347) is used for UDP-based transport class 0/1 communications.
  • Security Profiles named in the document include EtherNet/IP Confidentiality Profile, CIP User Authentication Profile, Resource-Constrained CIP Security Profile, and Pull Model Profile.
  • Device authentication uses X.509 certificates or pre-shared keys; certificate enrollment can be done directly by the device.
  • Message integrity and authentication use a TLS message authentication code (HMAC); confidentiality is optional via message encryption negotiated in the TLS handshake.
  • User authentication uses OpenID Connect and can integrate with an OpenID Connect Identity Provider or be managed within a device.
  • The User Authentication Profile provides user-level authentication with roles and basic authorization via local and central user authentication.
  • The document states CIP Security can help adhere to cybersecurity regulations including IEC 62443 and the EU Cyber Resilience Act (CRA).
  • ODVA is described as an independent, not-for-profit organization that maintains EtherNet/IP.

Safety

  • The document positions CIP Security for use where risk to life, property, and operations is most critical.
  • The document lists deployment in zones where workers could potentially be hurt by motion equipment, devices that could reveal product recipes or manufacturing process secrets, and lines that could cause great environmental damage.
  • The document states adherence to cybersecurity regulations including IEC 62443 and the EU Cyber Resilience Act (CRA).
↑↓ navigate↵ openesc close