Secure and reliable remote access for the European XFEL control system

The collaboration work between the Stockholm University and DESY in Hamburg regarding the European XFEL is among other things aiming towards to provide access methods to the accelerator control system for the European XFEL project with the possibility of a secure and reliable access from remote places. The requested expansion of the control system has been designed as an extra layer for control and data transmissions integrated with systems for authentication and authorization. This makes it possible to have these remote access methods working side by side with more conventional access methods in the control system. This gives you the possibility to access the control system remotely with traditional, already in use rich clients implemented in Java and expanded with an extra layer for the remote communication or you can use other clients in the future, e.g. web applications. A key focus here is to implement these requirements and at the same time achieve good performance in a secure and reliable way. In this paper we will discuss how we implement these requirements, what parameters and security measures we are using in order to implement a reliable, secure and easy to use secured access layer and how it is integrated to the accelerator control system. The system is designed as a Service-Oriented Architecture (SOA) and implemented with the latest web service technology available at present in order to connect the different nodes such as control system nodes, application servers and different clients for control and monitoring with quality of service (QoS). The architecture and the chosen access security manager (OpenSSO) for authentication and authorization will be described in its parts and how they are integrated. We will present our experiences of the architecture so far, what design choices we have found suitable in order to meet the requirements of a modern control system and what performance we have achieved when transporting data and commands in a reliable wa- .