Security

EYE+ comes with built-in security features: a secure connection using an SSL/TLS certificate and User Access Control to restrict access to EYE+ Studio to authenticated users only.

The Security page consists of two sections:

../../_images/configuration_security.png

Fig. 228 SECURITY main page

Secure Connection

EYE+ can set up an encrypted connection between EYE+ Studio and EYE+ Controller. This ensures that exchanged data cannot be read by third parties and remains protected from malicious actors monitoring the connection.

Warning

We recommend creating a Create a Backup of your system before enabling this feature. This precaution ensures that if you experience any unexpected issues, you can easily restore your system. In the unlikely event that a factory reset is necessary to regain access, your backup will help you restore your system quickly.

To set up this connection, EYE+ requires an SSL/TLS certificate and its associated private key. The private key is stored securely on EYE+, while the certificate provides the public key used by EYE+ Studio to establish a secure connection.

For more information about SSL/TLS certificates, please refer to the SSL/TLS Certificate chapter of the knowledge database.

You can import a certificate file in the .pem format, and the file must contain both the certificate and the private key. If you have both in separate files, you can merge them into one .pem easily provided you keep the headers for each section (the “-----BEGIN XXXXX-----” and “-----END XXXXX-----”).

../../_images/configuration_security_no_certificate.png

Fig. 229 SECURE CONNECTION Import a certificate

Once imported, some information about the certificate will be displayed, such as the issuer, expiration date, fingerprint and more. The certificate can be changed at any time.

../../_images/configuration_security_with_certificate.png

Fig. 230 SECURE CONNECTION certificate imported

Important

Once you upload the certificate and save it with the dedicated button, EYE+ Studio will be redirected to a secure route on port 443. Make sure it is not blocked by your firewall, or it will not be possible to access EYE+ Studio.

In case you are sure the port is not being blocked and you still cannot access EYE+ Studio, try refreshing the page and/or power cycle the EYE+ Controller. At this point in time, restarting the EYE+ Controller will remove the certificate so you can upload a new one.

Note

If you try to connect to EYE+ Studio but the certificate is expired, your browser will show a warning message and you’ll have to either accept a non-secure connection so you can update the certificate, or perform a factory reset using the dedicated button on the EYE+ Controller.

Important

With Secure Connection enabled, performing a system backup will also backup the SSL/TLS certificate in the backup file unencrypted.

User Access Control

With User Access Control (UAC), you can prevent unauthorized users from accessing EYE+ Studio. Only authorized users can modify your system.

UAC defines two users: ADMIN and ANONYMOUS. The former has access to all features of EYE+ Studio, while the latter either has none or can be allowed to monitor production through the dashboard.

To enable UAC, you need to define a password for the ADMIN user and whether to allow ANONYMOUS users to see the dashboard while in production.

../../_images/enable_uac.png

Fig. 231 UAC settings

Important

As with the secure connection feature, we recommend backing up your system before enabling UAC. Should you forget your password, your data will be unrecoverable and you will need to perform a factory reset to regain access to your EYE+.

UAC does not affect communication protocols between EYE+ and external systems. Any TCP/IP or fieldbus connection is not restricted by UAC.

To increase security, we encourage you to choose a strong password. Here are a few recommendations to create a strong password:

  • Aim for at least 12 characters. The longer the password, the harder it is to crack.

  • Use a combination of uppercase and lowercase letters, numbers, and symbols.

  • Don’t use dictionary words, personal information (birthdays, addresses), common phrases, or keyboard patterns.

  • Never reuse passwords across different accounts.

  • Make it easy to remember by using a random sentence or phrase and incorporate some uppercase letters, numbers, and symbols.

Cybersecurity

We strongly encourage you to enable the secure connection feature alongside UAC to improve the overall security of your system.

Once you choose a password and save it, you will automatically be logged in as ADMIN. Once logged in, you will stay that way for 30 minutes of inactivity (e.g. without navigating to a different page), after which you will have to log in again. You can also choose to log out at any time using the dedicated button on the rightmost part of the top bar.

Logging into EYE+ Studio is done per session, which means you can be connected to it from multiple computers at once with the same credentials. All sessions can log out independently and have their own inactivity timeout.

If you try to access EYE+ Studio with UAC enabled but aren’t logged in, you will be greeted by the login page where you will be asked for your password to authenticate.

../../_images/login_page.png

Fig. 232 Login page

To change your password, you first need to be logged in. Navigate to the SECURITY card in CONFIGURATION. The UAC card lets you modify your password. You need to first type in your current password and then the new one twice before saving. Once the verification succeeds, your password will be modified.

../../_images/change_password_uac.png

Fig. 233 Change UAC password

Cybersecurity

With UAC enabled, performing a system backup also includes the password in the backup file. The password is stored as a hash and cannot be read directly. If you restore a backup with UAC enabled, the hashed password stored in that backup is restored as well.