IEC 62351

IEC 62351-8 defines a granular role-based access control model specifically tailored for power systems. It maps organizational roles—such as operator, engineer, and auditor—to specific permissions for interacting with substation devices.

• Subject-to-Role Mapping: Associates authenticated users with predefined roles.
• Role-to-Rights Mapping: Defines exactly which data objects and control actions each role can access.
• Operational Context: Ensures that only authorized personnel can issue critical commands like Select Before Operate (SBO) sequences.

IEC 62351-3 mandates TLS encryption for TCP/IP-based protocols like IEC 61850 MMS, ensuring confidentiality and integrity between clients and servers. This prevents eavesdropping and man-in-the-middle attacks on operational communication.

• Mutual Authentication: Both client and server verify each other's identity using X.509 certificates.
• Data Integrity: Message Authentication Codes (MACs) guarantee that commands have not been tampered with in transit.
• Confidentiality: Encrypts sensitive payloads such as real-time measurement data and control commands.

IEC 62351-6 addresses the unique challenge of securing multicast GOOSE and Sampled Values messages, which require ultra-low latency. Traditional encryption is too slow, so the standard specifies a digital signature mechanism.

• Zero Recovery Time: Uses RSA signatures appended to the message to verify integrity without adding handshake latency.
• Replay Protection: Includes sequence numbers and timestamps to prevent attackers from capturing and retransmitting valid commands.
• Computational Offload: Allows for hardware-accelerated signature verification in Intelligent Electronic Devices (IEDs).

IEC 62351-9 defines a framework for managing the cryptographic keys and digital certificates used across the entire substation network. This centralized approach is critical for maintaining security posture at scale.

• Certificate Lifecycle: Automates the issuance, renewal, and revocation of X.509 certificates for IEDs and engineering workstations.
• Group Keys: Distributes symmetric keys for efficient multicast communication, reducing the overhead of individual key exchanges.
• Security Event Logging: Tracks all key management operations for forensic auditing and compliance reporting.

IEC 62351-7 provides a data model for network and system management (NSM) that monitors the health and security of the communication infrastructure itself. It generates structured logs for integration with Intrusion Detection Systems (IDS) and SIEM platforms.

• Security Event Logging: Captures failed authentication attempts, certificate errors, and protocol violations.
• Performance Metrics: Monitors network latency and packet loss that could indicate a denial-of-service attack.
• Compliance Auditing: Provides the raw data necessary to demonstrate adherence to NERC CIP and other regulatory frameworks.

IEC 62351-5 secures legacy serial communication channels, such as those used by DNP3 and IEC 60870-5, which are common in SCADA systems. It provides a bump-in-the-wire solution that adds authentication without replacing existing infrastructure.

• Challenge-Response Mechanism: Prevents replay attacks by requiring a unique, unpredictable challenge for each command.
• Data Integrity: Appends a cryptographic hash to ensure that telemetry data has not been modified during transmission.
• Bump-in-the-Wire: Can be implemented via external hardware modules, preserving investment in legacy Remote Terminal Units (RTUs).