Role-Based Access Control (RBAC)

Permissions are not assigned directly to users but are instead aggregated into roles that correspond to job functions. A user is assigned one or more roles, and through those role assignments acquires the permissions to perform particular system operations.

• Operator Role: Permitted to execute Select Before Operate (SBO) commands and acknowledge alarms.
• Protection Engineer Role: Permitted to modify IED settings and upload new SCL configuration files.
• Viewer Role: Read-only access to SCADA dashboards and Disturbance Recorder files.

This decoupling of users from permissions dramatically simplifies administration, especially during personnel changes or audits.

A permission is an approval to perform an operation on one or more protected objects within the substation automation system. In the context of IEC 61850, these operations map to specific services.

• Read: Access to view Logical Node data attributes (e.g., XCBR.Pos.stVal).
• Write: Authority to modify writable data attributes or issue control commands.
• Execute: Authority to run specific functions, such as triggering a Disturbance Recorder or initiating a firmware update.
• Security Administration: The ability to create, modify, or delete user accounts and role definitions, typically reserved for a dedicated Security Administrator role.

A session is a mapping between a user and a subset of assigned roles that are activated for a specific task. RBAC principles, particularly as defined in IEC 62351-8, support the concept of least privilege by allowing a user to activate only the minimum set of roles required for the current task.

• Default Session: Activates the user's standard role (e.g., Operator) upon login.
• Elevated Session: A Protection Engineer temporarily activates a role with write permissions to modify a Synchrocheck setting, with the session automatically expiring after a configurable timeout.
• Audit Trail: Every session activation and role escalation event is logged for forensic analysis.

Constraints enforce mandatory rules that limit the power of roles, preventing conflicts of interest and ensuring operational safety. Separation of Duty (SoD) is a critical constraint in substation environments.

• Static SoD: Prevents a single user from being permanently assigned to conflicting roles (e.g., the same user cannot hold both the IED Configuration role and the Configuration Approval role).
• Dynamic SoD: Allows a user to be assigned conflicting roles but prevents them from activating both in the same session. For example, an engineer can design a protection scheme and later approve a different one, but cannot approve their own.
• Time-based Constraints: Restrict a role's activation to a specific maintenance window, preventing a Protection Engineer from modifying settings during peak load hours.

The IEC 62351-8 standard specifically defines RBAC for power system communications, extending the abstract models of IEC 61850 with concrete access tokens.

• Subject: The entity requesting access (a human user or a software agent).
• Role: A defined set of rights (e.g., Operator, Engineer, SecurityAdmin).
• Access Token: A digitally signed JSON Web Token (JWT) that encapsulates the user's identity, assigned roles, and token validity period. This token is presented to IEDs and SCADA servers to authorize specific MMS or GOOSE operations.
• Centralized Policy: Role-permission mappings are managed centrally in an LDAP or Active Directory server and pushed to substation devices.

A two-step control security mechanism that complements RBAC by adding an operational safety layer. The process requires:

• Step 1: Operator selects a switchgear object and receives positive confirmation
• Step 2: Operator issues the execute command This prevents unintended operations even when a user has the correct role permissions, acting as a final human-in-the-loop verification before any state change occurs in the substation.

A passive monitoring application that validates RBAC enforcement by performing deep packet inspection on GOOSE, SV, and MMS traffic. The IDS detects anomalous commands such as a maintenance engineer role attempting to issue protection setting changes—a permission reserved for protection engineers. This creates an audit trail of access violations and potential credential misuse within the operational technology network.

A unidirectional security gateway that physically enforces one-way data flow from OT to IT networks. In an RBAC context, data diodes ensure that even users with administrative roles on the enterprise network cannot send commands back to substation IEDs. This hardware-enforced boundary complements software-based role restrictions by eliminating the physical path for remote control from lower-security domains.

The XML-based language defined by IEC 61850-6 that formally describes IED capabilities and access control configurations. SCL files define which Logical Nodes each user role can access, specifying read/write permissions for functions like distance protection (PDIS) or circuit breaker control (XCBR). This declarative approach allows utilities to audit and version-control their RBAC policies as part of the substation engineering workflow.

The centralized control system where RBAC policies are most visibly enforced. SCADA platforms implement role-based views that filter the operator interface based on user roles:

• Operators: Full control of breaker operations and alarm acknowledgment
• Engineers: Access to protection settings and configuration changes
• Auditors: Read-only access to historical trends and event logs This ensures each user sees only the controls and data relevant to their function.