EN IEC 62351-4:2018

Power systems management and associated information exchange - Data and communications security - Part 4: Profiles including MMS and derivatives

1.1 General This part of IEC 62351 extends the scope of IEC TS 62351-4:2007 [1]1 by specifying a compatibility mode that provides interoperation with implementation based on IEC TS 62351- 4:2007 and by specifying extended capabilities referred to as native mode. This part of IEC 62351 specifies security requirements both at the transport layer and at the application layer. While IEC TS 62351-4:2007 primarily provided some limited support at the application layer for authentication during handshake for the Manufacturing Message Specification (MMS) based applications, this document also provides support for extended integrity and authentication both for the handshake phase and for the data transfer phase. It provides for shared key management and data transfer encryption at the application layer and it provides security end-to-end (E2E) with zero or more intermediate entities. While IEC TS 62351-4:2007 only provides support for systems based on the MMS, i.e. systems using an Open Systems Interworking (OSI) protocol stack, this document also provides support for application protocols using other protocol stacks, e.g. an Internet protocol suite (see 4.1). This support is extended to protect application protocols using XML encoding. This extended security at the application layer is referred to as E2E-security. In addition to E2E security, this part of IEC 62351 also provides mapping to environmental protocols carrying the security related information. Only OSI and XMPP environments are currently considered. It is intended that this part of IEC 62351 be referenced as a normative part of standards that have a need for using application protocols, e.g., MMS, in a secure manner. It is anticipated that there are implementations, in particular Inter-Control Centre Communications Protocol (ICCP) implementations that are dependent on the IEC TS 62351- 4:2007 specifications of the T-profile and the A-security-profile. The specifications from IEC TS 62351-4:2007 are therefore included in this part of IEC 62351. Implementations supporting these specifications will interwork with implementation based on IEC TS 62351-4:2007. NOTE The A-security-profile is in the strict sense not a profile, but the term is here kept for historical reasons. This document represents a set of mandatory and optional security specifications to be implemented to protect application protocols. The initial audience for this document is the members of the working groups developing or making use of protocols. For the measures described in this part of IEC 62351 to take effect, they shall be accepted and referenced by the specifications for the protocols themselves. The subsequent audience for this document is the developers of products that implement these protocols and the end user that want to specify requirements for its own environment. Portions of this document may also be of use to managers and executives in order to understand the purpose and requirements of the work.

Energiemanagementsysteme und zugehöriger Datenaustausch - IT-Sicherheit für Daten und Kommunikation - Teil 4: Profile einschließlich MMS und Ableitungen

Gestion des systèmes de puissance et échanges d'informations associés - Sécurité des communications et des données - Partie 4 : Profils comprenant MMS

IEC 62351:2018 spécifie les exigences de sécurité concernant à la fois la couche transport et la couche application. Alors que l’IEC TS 62351-4:2007 apportait principalement une aide limitée concernant la couche application pour l’authentification lors de l’établissement de liaison des applications fondées sur la messagerie MMS (manufacturing message specification), le présent document fournit également une assistance quant à l’extension de l’intégrité et l’authentification lors des phases d’établissement de liaison et de transfert de données. Il pourvoit à la gestion essentielle partagée et au chiffrement de transfert de données pour la couche application et assure la sécurité bout-à-bout (E2E - end-to-end) avec zéro entité intermédiaire ou plus. Alors que l’IEC TS 62351-4:2007 apporte une assistance uniquement pour les systèmes fondés sur la MMS, c’est-à-dire les systèmes utilisant une pile de protocoles OSI (open systems interworking - interconnexion de systèmes ouverts), le présent document fournit également une assistance quant aux protocoles d’application utilisant d’autres piles de protocoles, par exemple une suite de protocoles Internet (voir 4.1). Cette assistance est étendue afin d’assurer la protection des protocoles d’application utilisant le codage XML. Cette sécurité étendue au niveau de la couche application est appelée sécurité E2E. En plus de la sécurité E2E, la présente partie de l’IEC 62351 présente également la mise en correspondance avec les protocoles environnementaux comportant les informations concernant la sécurité. Seuls les environnements OSI et XMPP sont actuellement pris en considération.

Upravljanje elektroenergetskega sistema in pripadajoča izmenjava informacij - Varnost podatkov in komunikacij - 4. del: Profili, vključno z MMS in izpeljankami

Ta del standarda IEC 62351 razširja področje uporabe standarda IEC TS 62351-4:2007 [1]1, saj določa način združljivosti, ki zagotavlja interoperabilnost z izvajanjem na podlagi standarda IEC TS 62351-4:2007 in določa razširjene zmogljivosti, imenovane nativni način.
Ta del standarda IEC 62351 določa varnostne zahteve tako na transportni kot na aplikacijski plasti. Medtem ko je IEC TS 62351-4:2007 primarno zagotovil omejeno podporo na aplikacijski plasti za preverjanje pristnosti med rokovanjem z aplikacijami na osnovi MMS (Manufacturing Message Specification), pa ta dokument zagotavlja tudi podporo za razširjeno integriteto in preverjanje pristnosti tako za fazo rokovanja kot za fazo prenosa podatkov. Zagotavlja upravljanje s ključem v skupni rabi, šifriranje prenosa podatkov na aplikacijski plasti in celostno varnost (E2E) z nič ali več vmesnimi enotami. Medtem ko IEC TS 62351-4:2007 zagotavlja podporo samo za sisteme na osnovi MMS, tj. sisteme, ki uporabljajo sklad protokolov OSI (Open Systems Interworking), pa ta dokument zagotavlja tudi podporo za aplikacijske protokole, ki uporabljajo druge sklade protokolov, npr. zbirko internetnih protokolov (glej 4.1)
Ta podpora je razširjena za zaščito aplikacijskih protokolov s kodiranjem XML. Ta razširjena varnost na aplikacijski plasti se imenuje E2E-varnost.
Poleg E2E-varnosti zagotavlja ta del standarda IEC 62351 tudi preslikavo v okoljske protokole, ki vsebujejo informacije v zvezi z varnostjo. Trenutno so obravnavana samo okolja OSI in XMPP.
Ta del standarda IEC 62351 naj bi bil normativni del standardov, v katerih je zahtevana varna uporaba aplikacijskih protokolov, npr. MMS.
Predvidoma obstajajo izvedbe, zlasti izvedbe komunikacijskega protokola ICCP (Inter-Control Centre Communications Protocol), ki so odvisne od specifikacij T-profila in A-varnostnega profila iz standarda IEC TS 62351- 4:2007. Specifikacije iz standarda IEC TS 62351-4:2007 so zato vključene v ta del standarda IEC 62351. Izvedbe, ki podpirajo te specifikacije, se bodo lahko povezovale z izvedbami na podlagi standarda IEC TS 62351-4:2007.
OPOMBA: A-varnostni profil v strogem pomenu besede ni profil, ampak je izraz, ohranjen zaradi zgodovinskih razlogov.
Ta dokument predstavlja niz obveznih in neobveznih varnostnih specifikacij, ki jih je treba uporabiti za zaščito aplikacijskih protokolov.
Namembni uporabniki tega dokumenta so člani delovnih skupin, ki razvijajo ali uporabljajo protokole. Ukrepi, opisani v tem delu standarda IEC 62351, stopijo v veljavo, ko so sprejeti in sklicevani v samih specifikacijah protokolov.
Drugi uporabniki tega dokumenta so lahko tudi razvijalci izdelkov, ki uvajajo te protokole, in končni uporabnik, ki želi določiti zahteve za lastno okolje.
Deli tega dokumenta lahko pomagajo tudi direktorjem in vodjem pri razumevanju namena in zahtev dela.

General Information

• Status: Published
• Publication Date: 20-Dec-2018
• Withdrawal Date: 19-Dec-2021
• ICS: 33.200 - Telecontrol. Telemetering
• Technical Committee: CLC/TC 57 - Power systems management and associated information exchange
• Drafting Committee: IEC/TC 57 - IEC_TC_57
• Current Stage: 6060 - Document made available - Publishing
• Start Date: 21-Dec-2018
• Completion Date: 21-Dec-2018
• Ref Project: SIST EN IEC 62351-4:2019 - Power systems management and associated information exchange - Data and communications security - Part 4: Profiles including MMS and derivatives

Relations

• Amended By: EN IEC 62351-4:2018/A1:2020 - Power systems management and associated information exchange - Data and communications security - Part 4: Profiles including MMS and derivatives
• Effective Date: 16-Jul-2019

Standards Content (Sample)

SLOVENSKI STANDARD
SIST EN IEC 62351-4:2019
01-marec-2019
8SUDYOMDQMHHOHNWURHQHUJHWVNHJDVLVWHPDLQSULSDGDMRþDL]PHQMDYDLQIRUPDFLM
9DUQRVWSRGDWNRYLQNRPXQLNDFLMGHO3URILOLYNOMXþQR]006LQL]SHOMDQNDPL
Power systems management and associated information exchange - Data and
communications security - Part 4: Profiles including MMS and derivatives
Energiemanagementsysteme und zugehöriger Datenaustausch - IT-Sicherheit für Daten
und Kommunikation - Teil 4: Profile einschließlich MMS und Ableitungen
Gestion des systèmes de puissance et échanges d'informations associés - Sécurité des
communications et des données - Partie 4 : Profils comprenant MMS
Ta slovenski standard je istoveten z: EN IEC 62351-4:2018
ICS:
29.240.30 Krmilna oprema za Control equipment for electric
elektroenergetske sisteme power systems
35.240.50 Uporabniške rešitve IT v IT applications in industry
industriji
SIST EN IEC 62351-4:2019 en
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

---------------------- Page: 1 ----------------------

SIST EN IEC 62351-4:2019

---------------------- Page: 2 ----------------------

SIST EN IEC 62351-4:2019


EUROPEAN STANDARD EN IEC 62351-4

NORME EUROPÉENNE

EUROPÄISCHE NORM
December 2018
ICS 33.200

English Version
Power systems management and associated information
exchange - Data and communications security - Part 4: Profiles
including MMS and derivatives
(IEC 62351-4:2018)
Gestion des systèmes de puissance et échanges Energiemanagementsysteme und zugehöriger
d'informations associés - Sécurité des communications et Datenaustausch - IT-Sicherheit für Daten und
des données - Partie 4 : Profils comprenant MMS Kommunikation - Teil 4: Profile einschließlich MMS und
(IEC 62351-4:2018) Ableitungen
(IEC 62351-4:2018)
This European Standard was approved by CENELEC on 2018-12-20. CENELEC members are bound to comply with the CEN/CENELEC
Internal Regulations which stipulate the conditions for giving this European Standard the status of a national standard without any alteration.
Up-to-date lists and bibliographical references concerning such national standards may be obtained on application to the CEN-CENELEC
Management Centre or to any CENELEC member.
This European Standard exists in three official versions (English, French, German). A version in any other language made by translation
under the responsibility of a CENELEC member into its own language and notified to the CEN-CENELEC Management Centre has the
same status as the official versions.
CENELEC members are the national electrotechnical committees of Austria, Belgium, Bulgaria, Croatia, Cyprus, the Czech Republic,
Denmark, Estonia, Finland, Former Yugoslav Republic of Macedonia, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia,
Lithuania, Luxembourg, Malta, the Netherlands, Norway, Poland, Portugal, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden,
Switzerland, Turkey and the United Kingdom.


European Committee for Electrotechnical Standardization
Comité Européen de Normalisation Electrotechnique
Europäisches Komitee für Elektrotechnische Normung
CEN-CENELEC Management Centre: Rue de la Science 23, B-1040 Brussels
© 2018 CENELEC All rights of exploitation in any form and by any means reserved worldwide for CENELEC Members.
 Ref. No. EN IEC 62351-4:2018 E

---------------------- Page: 3 ----------------------

SIST EN IEC 62351-4:2019
EN IEC 62351-4:2018 (E)
European foreword
The text of document 57/2032/FDIS, future edition 1 of IEC 62351-4, prepared by IEC/TC 57 "Power
systems management and associated information exchange" was submitted to the IEC-CENELEC
parallel vote and approved by CENELEC as EN IEC 62351-4:2018.
The following dates are fixed:
• latest date by which the document has to be implemented at national (dop) 2019-09-20
level by publication of an identical national standard or by endorsement
• latest date by which the national standards conflicting with the (dow) 2021-12-20
document have to be withdrawn

Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. CENELEC shall not be held responsible for identifying any or all such patent rights.

Endorsement notice
The text of the International Standard IEC 62351-4:2018 was approved by CENELEC as a European
Standard without any modification.

In the official version, for Bibliography, the following notes have to be added for the standards
indicated:
IEC 60870-6-503:2014 NOTE Harmonized as EN 60870-6-503:2014 (not modified)
IEC 60870-6-702:2014 NOTE Harmonized as EN 60870-6-702:2014 (not modified)
IEC 60870-6-802:2014 NOTE Harmonized as EN 60870-6-802:2014 (not modified)

2

---------------------- Page: 4 ----------------------

SIST EN IEC 62351-4:2019
EN IEC 62351-4:2018 (E)
Annex ZA
(normative)

Normative references to international publi
...