iTeh StandardsiTeh Standards
EURUSD
Your shopping cart is empty.
SIST

oSIST prEN IEC 62351-7:2024

(Main)

Power systems management and associated information exchange - Data and communications security - Part 7: Network and system management (NSM) data object models

Power systems management and associated information exchange - Data and communications security - Part 7: Network and system management (NSM) data object models

Datenmodelle, Schnittstellen und Informationsaustausch für Planung und Betrieb von Energieversorgungsunternehmen – Daten- und Kommunikationssicherheit - Teil 7: Datenobjektmodelle für Netzwerk- und Systemmanagement (NSM)

Gestion des systèmes de puissance et échanges d'informations associés - Sécurité des communications et des données - Partie 7: Modèles d’objets de données de gestion de réseaux et de systèmes (NSM)

Upravljanje elektroenergetskega sistema in pripadajoča izmenjava informacij - Varnost podatkov in komunikacij - 7. del: Podatkovni modeli pri upravljanju omrežij in sistemov (NSM)

General Information

Status
Not Published
Public Enquiry End Date
29-Apr-2024
ICS
29.240.30 - Control equipment for electric power systems
35.240.50 - IT applications in industry
Technical Committee
PSE - Power systems management
Current Stage
4020 - Public enquire (PE) (Adopted Project)
Start Date
14-Feb-2024
Due Date
03-Jul-2024
Mandate
M/490 - Standardisation mandate to the European Standardisation Organisations (ESOs) to support European Smart Grid deployment
Ref Project
prEN IEC 62351-7:2024 - Power systems management and associated information exchange - Data and communications security - Part 7: Network and system management (NSM) data object models

Relations

Revises
SIST EN 62351-7:2018 - Power systems management and associated information exchange - Data and communications security - Part 7: Network and System management (NSM) data object models
Effective Date
07-Jun-2022

Buy Standard

prEN IEC 62351-7:2024 - BARVEprEN IEC 62351-7:2024 - BARVE
PreviousNext
Draft
prEN IEC 62351-7:2024 - BARVE
English language
126 pages
sale 10% off
Preview
sale 10% off
Preview
e-Library read for
1 day

Standards Content (Sample)

SLOVENSKI STANDARD
oSIST prEN IEC 62351-7:2024
01-april-2024
Upravljanje elektroenergetskega sistema in pripadajoča izmenjava informacij -
Varnost podatkov in komunikacij - 7. del: Podatkovni modeli pri upravljanju
omrežij in sistemov (NSM)
Power systems management and associated information exchange - Data and
communications security - Part 7: Network and system management (NSM) data object
models
Datenmodelle, Schnittstellen und Informationsaustausch für Planung und Betrieb von
Energieversorgungsunternehmen – Daten- und Kommunikationssicherheit - Teil 7:
Datenobjektmodelle für Netzwerk- und Systemmanagement (NSM)
Gestion des systèmes de puissance et échanges d'informations associés - Sécurité des
communications et des données - Partie 7: Modèles d’objets de données de gestion de
réseaux et de systèmes (NSM)
Ta slovenski standard je istoveten z: prEN IEC 62351-7:2024
ICS:
29.240.30 Krmilna oprema za Control equipment for electric
elektroenergetske sisteme power systems
35.240.50 Uporabniške rešitve IT v IT applications in industry
industriji
oSIST prEN IEC 62351-7:2024 en
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

---------------------- Page: 1 ----------------------
oSIST prEN IEC 62351-7:2024

---------------------- Page: 2 ----------------------
oSIST prEN IEC 62351-7:2024


57/2639/CDV

COMMITTEE DRAFT FOR VOTE (CDV)
PROJECT NUMBER:
IEC 62351-7 ED2
DATE OF CIRCULATION: CLOSING DATE FOR VOTING:
2024-02-09 2024-05-03
SUPERSEDES DOCUMENTS:
57/2583/CD, 57/2604A/CC

IEC TC 57 : POWER SYSTEMS MANAGEMENT AND ASSOCIATED INFORMATION EXCHANGE
SECRETARIAT: SECRETARY:
Germany Mr Heiko Englert
OF INTEREST TO THE FOLLOWING COMMITTEES: PROPOSED HORIZONTAL STANDARD:


Other TC/SCs are requested to indicate their interest, if any, in
this CDV to the secretary.
FUNCTIONS CONCERNED:
EMC ENVIRONMENT QUALITY ASSURANCE SAFETY
SUBMITTED FOR CENELEC PARALLEL VOTING NOT SUBMITTED FOR CENELEC PARALLEL VOTING
Attention IEC-CENELEC parallel voting
The attention of IEC National Committees, members of CENELEC,
is drawn to the fact that this Committee Draft for Vote (CDV) is
submitted for parallel voting.
The CENELEC members are invited to vote through the CENELEC
online voting system.

This document is still under study and subject to change. It should not be used for reference purposes.
Recipients of this document are invited to submit, with their comments, notification of any relevant patent rights of which they are
aware and to provide supporting documentation.
Recipients of this document are invited to submit, with their comments, notification of any relevant “In Some Countries” clau ses to be
included should this proposal proceed. Recipients are reminded that the CDV stage is the final stage for submitting ISC c lauses.
(SEE AC/22/2007 OR NEW GUIDANCE DOC).

TITLE:
Power systems management and associated information exchange - Data and communications security - Part
7: Network and System Management (NSM) data object models

PROPOSED STABILITY DATE: 2025

NOTE FROM TC/SC OFFICERS:


Copyright © 2023 International Electrotechnical Commission, IEC. All rights reserved. It is permitted to download this
electronic file, to make a copy and to print out the content for the sole purpose of preparing National Committee positions.

You may not copy or "mirror" the file or printed version of the document, or any part of it, for any other purpose without
permission in writing from IEC.

---------------------- Page: 3 ----------------------
oSIST prEN IEC 62351-7:2024
57/2639/CDV – 2 – IEC CDV 62351-7© IEC: 2024
CONTENTS
FOREWORD . 9
1 Scope . 11
2 Normative references . 11
3 Terms and definitions . 13
4 Abbreviated terms and acronyms . 14
5 Overview of Network and System Management (NSM) . 14
5.1 Objectives . 14
5.2 NSM concepts. 16
5.2.1 Simple Network Management Protocol (SNMP) . 16
5.2.2 ISO NSM categories . 16
5.2.3 NSM “data objects” for power system operations .
...

Questions, Comments and Discussion

Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.

This May Also Interest You

SIST
SIST EN IEC 62351-9:2023(Main)
Power systems management and associated information exchange - Data and communications security - Part 9: Cyber security key management for power system equipment (IEC 62351-9:2023)
EN IEC 62351-9:2023

IEC 62351-9:2023 specifies cryptographic key management, primarily focused on the management of long-term keys, which are most often asymmetric key pairs, such as public-key certificates and corresponding private keys. As certificates build the base this document builds a foundation for many IEC 62351 services (see also Annex A). Symmetric key management is also considered but only with respect to session keys for group-based communication as applied in IEC 62351-6. The objective of this document is to define requirements and technologies to achieve interoperability of key management by specifying or limiting key management options to be used.
This document assumes that an organization (or group of organizations) has defined a security policy to select the type of keys and cryptographic algorithms that will be utilized, which may have to align with other standards or regulatory requirements. This document therefore specifies only the management techniques for these selected key and cryptography infrastructures. This document assumes that the reader has a basic understanding of cryptography and key management principles.
The requirements for the management of pairwise symmetric (session) keys in the context of communication protocols is specified in the parts of IEC 62351 utilizing or specifying pairwise communication such as:
• IEC 62351-3 for TLS by profiling the TLS options
• IEC 62351-4 for the application layer end-to-end security
• IEC TS 62351-5 for the application layer security mechanism for IEC 60870-5-101/104 and IEEE 1815 (DNP3)
The requirements for the management of symmetric group keys in the context of power system communication protocols is specified in IEC 62351-6 for utilizing group security to protect GOOSE and SV communication. IEC 62351-9 utilizes GDOI as already IETF specified group-based key management protocol to manage the group security parameter and enhances this protocol to carry the security parameter for GOOSE, SV, and PTP.
This document also defines security events for specific conditions which could identify issues which might require error handling. However, the actions of the organisation in response to these error conditions are beyond the scope of this document and are expected to be defined by the organizations security policy.
In the future, as public-key cryptography becomes endangered by the evolution of quantum computers, this document will also consider post-quantum cryptography to a certain extent. Note that at this time being no specific measures are provided.
This second edition cancels and replaces the first edition published in 2017. This edition constitutes a technical revision.
This edition includes the following significant technical changes with respect to the previous edition:
a) Certificate components and verification of the certificate components have been added;
b) GDOI has been updated to include findings from interop tests;
c) GDOI operation considerations have been added;
d) GDOI support for PTP (IEEE 1588) support has been added as specified by IEC/IEEE 61850-9-3 Power Profile;
e) Cyber security event logging has been added as well as the mapping to IEC 62351-14;
f) Annex B with background on utilized cryptographic algorithms and mechanisms has been added.

  • Standard
    147 pages
    English language
    sale 10% off
    e-Library read for
    1 day
SIST
SIST EN IEC 62351-3:2023(Main)
Power systems management and associated information exchange - Data and communications security - Part 3: Communication network and system security - Profiles including TCP/IP (IEC 62351-3:2023)
EN IEC 62351-3:2023

IEC 62351-3:2023 specifies how to provide confidentiality, integrity protection, and message level authentication for protocols that make use of TCP/IP as a message transport layer and utilize Transport Layer Security when cyber-security is required. This may relate to SCADA and telecontrol protocols, but also to additional protocols if they meet the requirements in this document.
IEC 62351-3 specifies how to secure TCP/IP-based protocols through constraints on the specification of the messages, procedures, and algorithms of Transport Layer Security (TLS) (TLSv1.2 defined in RFC 5246, TLSv1.3 defined in RFC 8446). In the specific clauses, there will be subclauses to note the differences and commonalities in the application depending on the target TLS version. The use and specification of intervening external security devices (e.g., "bump-in-the-wire") are considered out-of-scope.
In contrast to previous editions of this document, this edition is self-contained in terms of completely defining a profile of TLS. Hence, it can be applied directly, without the need to specify further TLS parameters, except the port number, over which the communication will be performed. Therefore, this part can be directly utilized from a referencing standard and can be combined with further security measures on other layers. Providing the profiling of TLS without the need for further specifying TLS parameters allows declaring conformity to the described functionality without the need to involve further IEC 62351 documents.
This document is intended to be referenced as a normative part of other IEC standards that have the need for providing security for their TCP/IP-based protocol exchanges under similar boundary conditions. However, it is up to the individual protocol security initiatives to decide if this document is to be referenced.
The document also defines security events for specific conditions, which support error handling, security audit trails, intrusion detection, and conformance testing. Any action of an organization in response to events to an error condition described in this document are beyond the scope of this document and are expected to be defined by the organization’s security policy.
This document reflects the security requirements of the IEC power systems management protocols. Should other standards bring forward new requirements, this document may need to be revised.
This second edition cancels and replaces the first edition published in 2014, Amendment 1:2018 and Amendment 2:2020. This edition constitutes a technical revision.
This edition includes the following significant technical changes with respect to the previous edition:
a) Inclusion of the TLSv1.2 related parameter required in IEC 62351-3 Ed.1.2 to be specified by the referencing standard. This comprises the following parameter:
• Mandatory TLSv1.2 cipher suites to be supported.
• Specification of session resumption parameters.
• Specification of session renegotiation parameters.
• Revocation handling using CRL and OCSP.
• Handling of security events.
b) Inclusion of a TLSv1.3 profile to be applicable for the power system domain in a similar way as for TLSv1.2 session.

  • Standard
    52 pages
    English language
    sale 10% off
    e-Library read for
    1 day
  • Standard
    52 pages
    English language
    sale 10% off
    e-Library read for
    1 day
SIST
SIST EN IEC 62351-5:2023(Main)
Power systems management and associated information exchange - Data and communications security - Part 5: Security for IEC 60870-5 and derivatives (IEC 62351-5:2023)
EN IEC 62351-5:2023

This part of IEC 62351 defines the application authentication mechanism (A-profile) specifying messages, procedures and algorithms for securing the operation of all protocols based on or derived from IEC 60870-5: Telecontrol Equipment and Systems - Transmission Protocols.
This Standard applies to at least those protocols listed in Table 1.
[Table 1]
The initial audience for this International Standard is intended to be the members of the working groups developing the protocols listed in Table 1.
For the measures described in this standard to take effect, they must be accepted and referenced by the specifications for the protocols themselves. This document is written to enable that process. The working groups in charge of take this standard to the specific protocols listed in Table 1 may choose not to do so.
The subsequent audience for this specification is intended to be the developers of products that implement these protocols.
Portions of this standard may also be of use to managers and executives in order to understand the purpose and requirements of the work.
This document is organized working from the general to the specific, as follows:
- Clauses 2 through 4 provide background terms, definitions, and references.
- Clause 5 describes the problems this specification is intended to address.
- Clause 6 describes the mechanism generically without reference to a specific protocol.
- Clauses 7 and 8 describe the mechanism more precisely and are the primary normative part of this specification.
- Clause 9 define the interoperability requirements for this authentication mechanism.
- Clause 10 describes the requirements for other standards referencing this specification
Unless specifically labelled as informative or optional, all clauses of this specification are normative.

  • Standard
    126 pages
    English language
    sale 10% off
    e-Library read for
    1 day
SIST
SIST EN IEC 62351-6:2021(Main)
Power systems management and associated information exchange - Data and communications security - Part 6: Security for IEC 61850
EN IEC 62351-6:2020

This part of IEC 62351 specifies messages, procedures, and algorithms for securing the
operation of all protocols based on or derived from the IEC 61850 series.The initial audience for this document is intended to be the members of the working groups
developing or making use of the protocols listed in Table 1. For the measures described in this
specification to take effect, they must be accepted and referenced by the specifications for the
protocols themselves. This document is written to enable that process.
The subsequent audience for this document is intended to be the developers of products that
implement these protocols.
Portions of this document may also be of use to managers and executives in order to understand
the purpose and requirements of the work.

  • Standard
    37 pages
    English language
    sale 10% off
    e-Library read for
    1 day
SIST
SIST EN IEC 62351-4:2019/A1:2020(Amendment)
Power systems management and associated information exchange - Data and communications security - Part 4: Profiles including MMS and derivatives
EN IEC 62351-4:2018/A1:2020
  • Amendment
    44 pages
    English language
    sale 10% off
    e-Library read for
    1 day
SIST
SIST EN IEC 62351-8:2020(Main)
Power systems management and associated information exchange - Data and communications security - Part 8: Role-based access control for power system management
EN IEC 62351-8:2020

The scope of this part of IEC 62351 is to facilitate role-based access control (RBAC) for power
system management. RBAC assigns human users, automated systems, and software
applications (collectively called "subjects" in this document) to specified "roles", and restricts
their access to only those resources, which the security policies identify as necessary for their
roles.
As electric power systems become more automated and cyber security concerns become more
prominent, it is becoming increasingly critical to ensure that access to data (read, write, control,
etc.) is restricted. As in many aspects of security, RBAC is not just a technology; it is a way of
running a business. RBAC is not a new concept; in fact, it is used by many operating systems
to control access to system resources. Specifically, RBAC provides an alternative to the all-ornothing
super-user model in which all subjects have access to all data, including control
commands.
RBAC is a primary method to meet the security principle of least privilege, which states that no
subject should be authorized more permissions than necessary for performing that subject’s
task. With RBAC, authorization is separated from authentication. RBAC enables an organization
to subdivide super-user capabilities and package them into special user accounts termed roles
for assignment to specific individuals according to their associated duties. This subdivision
enables security policies to determine who or what systems are permitted access to which data
in other systems. RBAC provides thus a means of reallocating system controls as defined by
the organization policy. In particular, RBAC can protect sensitive system operations from
inadvertent (or deliberate) actions by unauthorized users. Clearly RBAC is not confined to
human users though; it applies equally well to automated systems and software applications,
i.e., software parts operating independent of user interactions.
The following interactions are in scope:
– local (direct wired) access to the object by a human user, a local and automated computer
agent, or a built-in HMI or panel;
– remote (via dial-up or wireless media) access to the object by a human user;
– remote (via dial-up or wireless media) access to the object by a remote automated computer
agent, e.g. another object at another substation, a distributed energy resource at an enduser’s
facility, or a control centre application.
While this document defines a set of mandatory roles to be supported, the exchange format for
defined specific or custom roles is also in scope of this document.
Out of scope for this document are all topics which are not directly related to the definition of
roles and access tokens for local and remote access, especially administrative or organizational
tasks, such as:
– user names and password definitions/policies;
– management of keys and/or key exchange;
– engineering process of roles;
– assignment of roles;
– selection of trusted certificate authorities issuing credentials (access tokens);
– defining the tasks of a security officer;
– integrating local policies in RBAC;
NOTE Specifically, the management of certificates is addressed in IEC 62351-9.
Existing standards (see ANSI INCITS 359-2004, IEC 62443 (all parts), and IEEE 802.1X-2004)
in process control industry and access control (RFC 2904 and RFC 2905) are not sufficient as
none of them specify neither the exact role name and associated permissions nor the format of
the access tokens nor the detailed mechanism by which access tokens are transferred to and
authenticated by the target system – all this information is needed though for interoperability.
On the other hand, IEEE 1686 already defines a minimum number of roles to be supported as
well as permissions, which are to be addressed by the roles. Note that IEEE 1686 is currently
being revised.

  • Standard
    77 pages
    English language
    sale 10% off
    e-Library read for
    1 day
SIST
SIST EN 62351-3:2015/A2:2020(Amendment)
Power systems management and associated information exchange - Data and communications security - Part 3: Communication network and system security - Profiles including TCP/IP
EN 62351-3:2014/A2:2020
  • Amendment
    13 pages
    English language
    sale 10% off
    e-Library read for
    1 day
SIST
SIST EN IEC 62351-4:2019(Main)
Power systems management and associated information exchange - Data and communications security - Part 4: Profiles including MMS and derivatives
EN IEC 62351-4:2018

This part of IEC 62351 extends the scope of IEC TS 62351-4:2007 [1]1 by specifying a
compatibility mode that provides interoperation with implementation based on IEC TS 62351-
4:2007 and by specifying extended capabilities referred to as native mode.
This part of IEC 62351 specifies security requirements both at the transport layer and at the
application layer. While IEC TS 62351-4:2007 primarily provided some limited support at the
application layer for authentication during handshake for the Manufacturing Message
Specification (MMS) based applications, this document also provides support for extended
integrity and authentication both for the handshake phase and for the data transfer phase. It
provides for shared key management and data transfer encryption at the application layer and
it provides security end-to-end (E2E) with zero or more intermediate entities. While IEC TS
62351-4:2007 only provides support for systems based on the MMS, i.e. systems using an
Open Systems Interworking (OSI) protocol stack, this document also provides support for
application protocols using other protocol stacks, e.g. an Internet protocol suite (see 4.1).
This support is extended to protect application protocols using XML encoding. This extended
security at the application layer is referred to as E2E-security.
In addition to E2E security, this part of IEC 62351 also provides mapping to environmental
protocols carrying the security related information. Only OSI and XMPP environments are
currently considered.
It is intended that this part of IEC 62351 be referenced as a normative part of standards that
have a need for using application protocols, e.g., MMS, in a secure manner.
It is anticipated that there are implementations, in particular Inter-Control Centre
Communications Protocol (ICCP) implementations that are dependent on the IEC TS 62351-
4:2007 specifications of the T-profile and the A-security-profile. The specifications from IEC
TS 62351-4:2007 are therefore included in this part of IEC 62351. Implementations supporting
these specifications will interwork with implementation based on IEC TS 62351-4:2007.
NOTE The A-security-profile is in the strict sense not a profile, but the term is here kept for historical reasons.
This document represents a set of mandatory and optional security specifications to be
implemented to protect application protocols.
The initial audience for this document is the members of the working groups developing or
making use of protocols. For the measures described in this part of IEC 62351 to take effect,
they shall be accepted and referenced by the specifications for the protocols themselves.
The subsequent audience for this document is the developers of products that implement
these protocols and the end user that want to specify requirements for its own environment.
Portions of this document may also be of use to managers and executives in order to
understand the purpose and requirements of the work.

  • Standard
    113 pages
    English language
    sale 10% off
    e-Library read for
    1 day
SIST
SIST EN 62351-3:2015/A1:2018(Amendment)
Power systems management and associated information exchange - Data and communications security - Part 3: Communication network and system security - Profiles including TCP/IP
EN 62351-3:2014/A1:2018

This part of IEC 62351 specifies how to provide confidentiality, integrity protection, and message level authentication for SCADA and telecontrol protocols that make use of TCP/IP as a message transport layer when cyber-security is required.
Although there are many possible solutions to secure TCP/IP, the particular scope of this part is to provide security between communicating entities at either end of a TCP/IP connection within the end communicating entities. The use and specification of intervening external security devices (e.g. “bump-in-the-wire”) are considered out-of-scope.
This part of IEC 62351 specifies how to secure TCP/IP-based protocols through constraints on the specification of the messages, procedures, and algorithms of Transport Layer Security (TLS) (defined in RFC 5246) so that they are applicable to the telecontrol environment of the IEC. TLS is applied to protect the TCP communication. It is intended that this standard be referenced as a normative part of other IEC standards that have the need for providing security for their TCP/IP-based protocol. However, it is up to the individual protocol security initiatives to decide if this standard is to be referenced.
This part of IEC 62351 reflects the security requirements of the IEC power systems management protocols. Should other standards bring forward new requirements, this standard may need to be revised.

  • Amendment
    11 pages
    English language
    sale 10% off
    e-Library read for
    1 day
SIST
SIST EN 62351-7:2018(Main)
Power systems management and associated information exchange - Data and communications security - Part 7: Network and System management (NSM) data object models
EN 62351-7:2017

This part of IEC 62351 defines network and system management (NSM) data object models
that are specific to power system operations. These NSM data objects will be used to monitor
the health of networks and systems, to detect possible security intrusions, and to manage the
performance and reliability of the information infrastructure. The goal is to define a set of
abstract objects that will allow the remote monitoring of the health and condition of IEDs
(Intelligent Electronic Devices), RTUs (Remote Terminal Units), DERs (Distributed Energy
Resources) systems and other systems that are important to power system operations.
Power systems operations are increasingly reliant on information infrastructures, including
communication networks, IEDs, and self-defining communication protocols. Therefore,
management of the information infrastructure has become crucial to providing the necessary
high levels of security and reliability in power system operations.
The telecommunication infrastructure that is in use for the transport of telecontrol and
automation protocols is already subject to health and condition monitoring control, using the
concepts developed in the IETF Simple Network Management Protocol (SNMP) standards for
network management. However, power system specific devices (like teleprotection,
telecontrol, substation automation, synchrophasors, inverters and protections) need instead a
specific solution for monitoring their health.
The NSM objects provide monitoring data for IEC protocols used for power systems
(IEC 61850, IEC 60870-5-104) and device specific environmental and security status. As a
derivative of IEC 60870-5-104, IEEE 1815 DNP3 is also included in the list of monitored
protocols. The NSM data objects use the naming conventions developed for IEC 61850,
expanded to address NSM issues. For the sake of generality these data objects, and the data
types of which they are comprised, are defined as abstract models of data objects.
In addition to the abstract model, in order to allow the integration of the monitoring of power
system devices within the NSM environment in this part of IEC 62351, a mapping of objects to
the SNMP protocol of Management Information Base (MIBs) is provided.
The objects that are already covered by existing MIBs are not defined here but are expected
to be compliant with existing MIB standards.

  • Standard
    237 pages
    English language
    sale 10% off
    e-Library read for
    1 day