SIST EN IEC 62351-4:2019

Power systems management and associated information exchange - Data and communications security - Part 4: Profiles including MMS and derivatives

This part of IEC 62351 extends the scope of IEC TS 62351-4:2007 [1]1 by specifying a
compatibility mode that provides interoperation with implementation based on IEC TS 62351-
4:2007 and by specifying extended capabilities referred to as native mode.
This part of IEC 62351 specifies security requirements both at the transport layer and at the
application layer. While IEC TS 62351-4:2007 primarily provided some limited support at the
application layer for authentication during handshake for the Manufacturing Message
Specification (MMS) based applications, this document also provides support for extended
integrity and authentication both for the handshake phase and for the data transfer phase. It
provides for shared key management and data transfer encryption at the application layer and
it provides security end-to-end (E2E) with zero or more intermediate entities. While IEC TS
62351-4:2007 only provides support for systems based on the MMS, i.e. systems using an
Open Systems Interworking (OSI) protocol stack, this document also provides support for
application protocols using other protocol stacks, e.g. an Internet protocol suite (see 4.1).
This support is extended to protect application protocols using XML encoding. This extended
security at the application layer is referred to as E2E-security.
In addition to E2E security, this part of IEC 62351 also provides mapping to environmental
protocols carrying the security related information. Only OSI and XMPP environments are
currently considered.
It is intended that this part of IEC 62351 be referenced as a normative part of standards that
have a need for using application protocols, e.g., MMS, in a secure manner.
It is anticipated that there are implementations, in particular Inter-Control Centre
Communications Protocol (ICCP) implementations that are dependent on the IEC TS 62351-
4:2007 specifications of the T-profile and the A-security-profile. The specifications from IEC
TS 62351-4:2007 are therefore included in this part of IEC 62351. Implementations supporting
these specifications will interwork with implementation based on IEC TS 62351-4:2007.
NOTE The A-security-profile is in the strict sense not a profile, but the term is here kept for historical reasons.
This document represents a set of mandatory and optional security specifications to be
implemented to protect application protocols.
The initial audience for this document is the members of the working groups developing or
making use of protocols. For the measures described in this part of IEC 62351 to take effect,
they shall be accepted and referenced by the specifications for the protocols themselves.
The subsequent audience for this document is the developers of products that implement
these protocols and the end user that want to specify requirements for its own environment.
Portions of this document may also be of use to managers and executives in order to
understand the purpose and requirements of the work.

Energiemanagementsysteme und zugehöriger Datenaustausch - IT-Sicherheit für Daten und Kommunikation - Teil 4: Profile einschließlich MMS und Ableitungen

Gestion des systèmes de puissance et échanges d'informations associés - Sécurité des communications et des données - Partie 4 : Profils comprenant MMS

IEC 62351:2018 spécifie les exigences de sécurité concernant à la fois la couche transport et la couche application. Alors que l’IEC TS 62351-4:2007 apportait principalement une aide limitée concernant la couche application pour l’authentification lors de l’établissement de liaison des applications fondées sur la messagerie MMS (manufacturing message specification), le présent document fournit également une assistance quant à l’extension de l’intégrité et l’authentification lors des phases d’établissement de liaison et de transfert de données. Il pourvoit à la gestion essentielle partagée et au chiffrement de transfert de données pour la couche application et assure la sécurité bout-à-bout (E2E - end-to-end) avec zéro entité intermédiaire ou plus. Alors que l’IEC TS 62351-4:2007 apporte une assistance uniquement pour les systèmes fondés sur la MMS, c’est-à-dire les systèmes utilisant une pile de protocoles OSI (open systems interworking - interconnexion de systèmes ouverts), le présent document fournit également une assistance quant aux protocoles d’application utilisant d’autres piles de protocoles, par exemple une suite de protocoles Internet (voir 4.1). Cette assistance est étendue afin d’assurer la protection des protocoles d’application utilisant le codage XML. Cette sécurité étendue au niveau de la couche application est appelée sécurité E2E.
En plus de la sécurité E2E, la présente partie de l’IEC 62351 présente également la mise en correspondance avec les protocoles environnementaux comportant les informations concernant la sécurité. Seuls les environnements OSI et XMPP sont actuellement pris en considération.

Upravljanje elektroenergetskega sistema in pripadajoča izmenjava informacij - Varnost podatkov in komunikacij - 4. del: Profili, vključno z MMS in izpeljankami

Ta del standarda IEC 62351 razširja področje uporabe standarda IEC TS 62351-4:2007 [1]1, saj določa način združljivosti, ki zagotavlja interoperabilnost z izvajanjem na podlagi standarda IEC TS 62351-4:2007 in določa razširjene zmogljivosti, imenovane nativni način.
Ta del standarda IEC 62351 določa varnostne zahteve tako na transportni kot na aplikacijski plasti. Medtem ko je IEC TS 62351-4:2007 primarno zagotovil omejeno podporo na aplikacijski plasti za preverjanje pristnosti med rokovanjem z aplikacijami na osnovi MMS (Manufacturing Message Specification), pa ta dokument zagotavlja tudi podporo za razširjeno integriteto in preverjanje pristnosti tako za fazo rokovanja kot za fazo prenosa podatkov. Zagotavlja upravljanje s ključem v skupni rabi, šifriranje prenosa podatkov na aplikacijski plasti in celostno varnost (E2E) z nič ali več vmesnimi enotami. Medtem ko IEC TS 62351-4:2007 zagotavlja podporo samo za sisteme na osnovi MMS, tj. sisteme, ki uporabljajo sklad protokolov OSI (Open Systems Interworking), pa ta dokument zagotavlja tudi podporo za aplikacijske protokole, ki uporabljajo druge sklade protokolov, npr. zbirko internetnih protokolov (glej 4.1)
Ta podpora je razširjena za zaščito aplikacijskih protokolov s kodiranjem XML. Ta razširjena varnost na aplikacijski plasti se imenuje E2E-varnost.
Poleg E2E-varnosti zagotavlja ta del standarda IEC 62351 tudi preslikavo v okoljske protokole, ki vsebujejo informacije v zvezi z varnostjo. Trenutno so obravnavana samo okolja OSI in XMPP.
Ta del standarda IEC 62351 naj bi bil normativni del standardov, v katerih je zahtevana varna uporaba aplikacijskih protokolov, npr. MMS.
Predvidoma obstajajo izvedbe, zlasti izvedbe komunikacijskega protokola ICCP (Inter-Control Centre Communications Protocol), ki so odvisne od specifikacij T-profila in A-varnostnega profila iz standarda IEC TS 62351- 4:2007. Specifikacije iz standarda IEC TS 62351-4:2007 so zato vključene v ta del standarda IEC 62351. Izvedbe, ki podpirajo te specifikacije, se bodo lahko povezovale z izvedbami na podlagi standarda IEC TS 62351-4:2007.
OPOMBA: A-varnostni profil v strogem pomenu besede ni profil, ampak je izraz, ohranjen zaradi zgodovinskih razlogov.
Ta dokument predstavlja niz obveznih in neobveznih varnostnih specifikacij, ki jih je treba uporabiti za zaščito aplikacijskih protokolov.
Namembni uporabniki tega dokumenta so člani delovnih skupin, ki razvijajo ali uporabljajo protokole. Ukrepi, opisani v tem delu standarda IEC 62351, stopijo v veljavo, ko so sprejeti in sklicevani v samih specifikacijah protokolov.
Drugi uporabniki tega dokumenta so lahko tudi razvijalci izdelkov, ki uvajajo te protokole, in končni uporabnik, ki želi določiti zahteve za lastno okolje.
Deli tega dokumenta lahko pomagajo tudi direktorjem in vodjem pri razumevanju namena in zahtev dela.

General Information

• Status: Published
• Public Enquiry End Date: 30-Sep-2017
• Publication Date: 10-Feb-2019
• ICS: 29.240.30 - Control equipment for electric power systems
• ICS: 35.240.50 - IT applications in industry
• Technical Committee: PSE - Power systems management
• Current Stage: 6060 - National Implementation/Publication (Adopted Project)
• Start Date: 10-Jan-2019
• Due Date: 17-Mar-2019
• Completion Date: 11-Feb-2019
• Ref Project: EN IEC 62351-4:2018 - Power systems management and associated information exchange - Data and communications security - Part 4: Profiles including MMS and derivatives

Relations

• Amended By: SIST EN IEC 62351-4:2019/A1:2020 - Power systems management and associated information exchange - Data and communications security - Part 4: Profiles including MMS and derivatives
• Effective Date: 01-Nov-2020

Standards Content (Sample)

SLOVENSKI STANDARD
SIST EN IEC 62351-4:2019
01-marec-2019
8SUDYOMDQMHHOHNWURHQHUJHWVNHJDVLVWHPDLQSULSDGDMRþDL]PHQMDYDLQIRUPDFLM
9DUQRVWSRGDWNRYLQNRPXQLNDFLMGHO3URILOLYNOMXþQR]006LQL]SHOMDQNDPL
Power systems management and associated information exchange - Data and
communications security - Part 4: Profiles including MMS and derivatives
Energiemanagementsysteme und zugehöriger Datenaustausch - IT-Sicherheit für Daten
und Kommunikation - Teil 4: Profile einschließlich MMS und Ableitungen
Gestion des systèmes de puissance et échanges d'informations associés - Sécurité des
communications et des données - Partie 4 : Profils comprenant MMS
Ta slovenski standard je istoveten z: EN IEC 62351-4:2018
ICS:
29.240.30 Krmilna oprema za Control equipment for electric
elektroenergetske sisteme power systems
35.240.50 Uporabniške rešitve IT v IT applications in industry
industriji
SIST EN IEC 62351-4:2019 en
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

---------------------- Page: 1 ----------------------

SIST EN IEC 62351-4:2019

---------------------- Page: 2 ----------------------

SIST EN IEC 62351-4:2019


EUROPEAN STANDARD EN IEC 62351-4

NORME EUROPÉENNE

EUROPÄISCHE NORM
December 2018
ICS 33.200

English Version
Power systems management and associated information
exchange - Data and communications security - Part 4: Profiles
including MMS and derivatives
(IEC 62351-4:2018)
Gestion des systèmes de puissance et échanges Energiemanagementsysteme und zugehöriger
d'informations associés - Sécurité des communications et Datenaustausch - IT-Sicherheit für Daten und
des données - Partie 4 : Profils comprenant MMS Kommunikation - Teil 4: Profile einschließlich MMS und
(IEC 62351-4:2018) Ableitungen
(IEC 62351-4:2018)
This European Standard was approved by CENELEC on 2018-12-20. CENELEC members are bound to comply with the CEN/CENELEC
Internal Regulations which stipulate the conditions for giving this European Standard the status of a national standard without any alteration.
Up-to-date lists and bibliographical references concerning such national standards may be obtained on application to the CEN-CENELEC
Management Centre or to any CENELEC member.
This European Standard exists in three official versions (English, French, German). A version in any other language made by translation
under the responsibility of a CENELEC member into its own language and notified to the CEN-CENELEC Management Centre has the
same status as the official versions.
CENELEC members are the national electrotechnical committees of Austria, Belgium, Bulgaria, Croatia, Cyprus, the Czech Republic,
Denmark, Estonia, Finland, Former Yugoslav Republic of Macedonia, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia,
Lithuania, Luxembourg, Malta, the Netherlands, Norway, Poland, Portugal, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden,
Switzerland, Turkey and the United Kingdom.


European Committee for Electrotechnical Standardization
Comité Européen de Normalisation Electrotechnique
Europäisches Komitee für Elektrotechnische Normung
CEN-CENELEC Management Centre: Rue de la Science 23, B-1040 Brussels
© 2018 CENELEC All rights of exploitation in any form and by any means reserved worldwide for CENELEC Members.
 Ref. No. EN IEC 62351-4:2018 E

---------------------- Page: 3 ----------------------

SIST EN IEC 62351-4:2019
EN IEC 62351-4:2018 (E)
European foreword
The text of document 57/2032/FDIS, future edition 1 of IEC 62351-4, prepared by IEC/TC 57 "Power
systems management and associated information exchange" was submitted to the IEC-CENELEC
parallel vote and approved by CENELEC as EN IEC 62351-4:2018.
The following dates are fixed:
• latest date by which the document has to be implemented at national (dop) 2019-09-20
level by publication of an identical national standard or by endorsement
• latest date by which the national standards conflicting with the (dow) 2021-12-20
document have to be withdrawn

Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. CENELEC shall not be held responsible for identifying any or all such patent rights.

Endorsement notice
The text of the International Standard IEC 62351-4:2018 was approved by CENELEC as a European
Standard without any modification.

In the official version, for Bibliography, the following notes have to be added for the standards
indicated:
IEC 60870-6-503:2014 NOTE Harmonized as EN 60870-6-503:2014 (not modified)
IEC 60870-6-702:2014 NOTE Harmonized as EN 60870-6-702:2014 (not modified)
IEC 60870-6-802:2014 NOTE Harmonized as EN 60870-6-802:2014 (not modified)

2

---------------------- Page: 4 ----------------------

SIST EN IEC 62351-4:2019
EN IEC 62351-4:2018 (E)
Annex ZA
(normative)

Normative references to international publications
with their corresponding European publications
The following documents are referred to in the text in such a way that some or all of their content
constitutes requirements of this document. For dated references, only the edition cited applies. For
undated references, the latest edition of the referenced document (including any amendments)
applies.
NOTE 1  Where an International Publication has been modified by common modifications, indicated by (mod), the relevant
EN/HD applies.
NOTE 2  Up-to-date information on the latest versions of the European Standards listed in this annex is available here:
www.cenelec.eu.

Publication Year Title EN/HD Year
IEC/TS 62351-1 -  Power systems management and associated - -
information exchange - Data and communications
security - Part 1: Communication network and
system security - Introduction to security issues
IEC/TS 62351-2 -  Power systems management and associated - -
information exchange - Data and communications
security - Part 2: Glossary of terms
IEC 62351-3 2014 Power systems management and associated EN 62351-3 2014
information exchange - Data and communications
security - Part 3: Communication network and
system security - Profiles including TCP/IP
+A1 2018  +A1 2018
IEC/TS 62351-8 2011 Power systems management and associated - -
information exchange - Data and communications
security - Part 8: Role-based access control
IEC 62351-9 2017 Power systems management and associated EN 62351-9 2017
information exchange - Data and communications
security - Part 9: Cyber security key management for
power system equipment
ISO/IEC 8073 1997 Information technology - Open Systems - -
Interconnection - Protocol for providing the
connection-mode transport service
ISO/IEC 8823-1 1994 Information technology - Open Systems - -
Interconnection - Connection-oriented presentation
protocol: Protocol specification
ISO/IEC 8824-1 -  Information technology - Abstract Syntax Notation - -
One (ASN.1): Specification of basic notation
3

---------------------- Page: 5 ----------------------

SIST EN IEC 62351-4:2019
EN IEC 62351-4:2018 (E)
ISO/IEC 8825-1 -  Information technology - ASN.1 encoding rules: - -
Specification of Basic Encoding Rules (BER),
Canonical Encoding Rules (CER) and Distinguished
Encoding Rules (DER)
ISO/IEC 8825-4 -  Information technology - ASN.1 encoding rules: XML - -
Encoding Rules (XER)
ISO 8601 2004 Data elements and interchange formats - - -
Information interchange - Representation of dates
and times
ISO 9506-2 2003 Industrial automation systems - Manufacturing - -
Message Specification - Part 2: Protocol
specification
ISO/IEC 9594-8 -  Information technology - Open Systems - -
Interconnection - The Directory - Part 8: Public-key
and attribute certificate frameworks
ITU-T -  Information technology - Open Systems - -
Recommendation Interconnection - Connection-oriented protocol for
X.227 the Association Control Service Element: Protocol
specification
+ A1 -   - -
IETF RFC 1006 1987 ISO Transport Service on top of the TCP, Version: 3 - -
IETF RFC 2104 1997 HMAC: Keyed-Hashing for Message Authentication - -
IETF RFC 3526 2003 More Modular Exponential (MODP) Diffie-Hellman - -
groups for Internet Key Exchange (IKE)
IETF RFC 5114 2003 Additional Diffie-Hellman Groups for Use with IETF - -
Standards
IETF RFC 5246 2008 The Transport Layer Security (TLS) Protocol Version - -
1.2
IETF RFC 5480 2009 Elliptic Curve Cryptography Subject Public Key - -
Information
IETF RFC 5639 2010 Elliptic Curve Cryptography (ECC) Brainpool - -
Standard Curves and Curve Generation
IETF RFC 5869 2010 HMAC-based Extract-and-Expand Key Derivation - -
Function
IETF RFC 6120 2011 Extensible Messaging and Presence Protocol - -
(XMPP): Core
IETF RFC 6122 2011 Extensible Messaging and Presence Protocol - -
(XMPP): Address Format


4

---------------------- Page: 6 ----------------------

SIST EN IEC 62351-4:2019




IEC 62351-4

®


Edition 1.0 2018-11




INTERNATIONAL



STANDARD








colour

inside










Power systems management and associated information exchange – Data and

communications security –

Part 4: Profiles including MMS and derivatives


























INTERNATIONAL

ELECTROTECHNICAL


COMMISSION





ICS 33.200 ISBN 978-2-8322-6262-7




  Warning! Make sure that you obtained this publication from an authorized distributor.


® Registered trademark of the International Electrotechnical Commission

---------------------- Page: 7 ----------------------

SIST EN IEC 62351-4:2019
– 2 – IEC 62351-4:2018 © IEC 2018
CONTENTS
FOREWORD . 8
1 Scope . 10
1.1 General . 10
1.2 Code components . 11
2 Normative references . 11
3 Terms, definitions and abbreviated terms . 12
3.1 General . 12
3.2 Terms and definitions . 13
3.3 Abbreviated terms . 16
4 Security issues addressed by this part of IEC 62351 . 17
4.1 Communications reference models . 17
4.2 Security for application and transport profiles . 18
4.3 Compatibility and native modes. 19
4.4 Security threats countered . 19
4.4.1 General . 19
4.4.2 Threats countered in compatibility mode . 20
4.4.3 Threats countered in native mode . 20
4.5 Attack methods countered . 20
4.5.1 General . 20
4.5.2 Attacks countered in compatibility mode . 20
4.5.3 Attacks countered in native mode . 20
4.6 Logging . 21
5 Specific requirements . 21
5.1 Specific requirements for ICCP/IEC 60870-6-x communication stack . 21
5.2 Specific requirements for IEC 61850 . 22
6 Transport Security . 22
6.1 General . 22
6.2 Application of transport layer security (TLS) . 22
6.2.1 General . 22
6.2.2 The TLS cipher suite concept . 23
6.2.3 TLS session resumption . 23
6.2.4 TLS session renegotiation . 23
6.2.5 Supported number of trust anchors . 23
6.2.6 Public-key certificate size . 23
6.2.7 Evaluation period for revocation state of public-key certificates . 23
6.2.8 Public-key certificate validation . 24
6.2.9 Security events handling . 24
6.3 T-security in an OSI operational environment . 24
6.3.1 General . 24
6.3.2 TCP ports . 24
6.3.3 Disabling of TLS . 25
6.3.4 TLS cipher suites support . 25
6.4 T-security in an XMPP operational environment . 26
7 Application layer security overview (informative) . 26
7.1 General . 26
7.2 Description techniques . 27

---------------------- Page: 8 ----------------------

SIST EN IEC 62351-4:2019
IEC 62351-4:2018 © IEC 2018 – 3 –
7.2.1 General . 27
7.2.2 ASN.1 as an XML schema definition . 27
7.2.3 W3C XML Schema Definition (W3C XSD) . 28
7.2.4 XML namespace . 28
8 Use of cryptographic algorithms . 28
8.1 General . 28
8.2 Basic cryptographic definitions . 28
8.3 Public-key algorithms . 29
8.4 Hash algorithms . 30
8.5 Signature algorithms . 30
8.6 Symmetric encryption algorithms used for encryption only . 30
8.7 Authenticated encryption algorithms . 31
8.8 Integrity check value algorithms . 31
9 Object identifier allocation (normative) . 32
10 General OSI upper layer requirements (normative) . 32
10.1 Overview. 32
10.2 General on OSI upper layer requirements . 33
10.3 Session protocol requirements . 33
10.4 Presentation protocol requirements . 34
10.4.1 Context list . 34
10.4.2 Abstract syntaxes . 34
10.4.3 Presentation user data . 34
10.4.4 ASN.1 encoding requirements . 35
10.5 Association control service element (ACSE) protocol requirements . 36
10.5.1 General . 36
10.5.2 Protocol version . 36
10.5.3 Titles . 36
10.5.4 Use of ASN.1 EXTERNAL data type . 36
11 A-security-profile (normative) . 37
11.1 OSI requirements specific to A-security profile . 37
11.1.1 General . 37
11.1.2 Additional session protocol requirements . 37
11.1.3 Additional presentation protocol requirement . 37
11.1.4 Additional ACSE requirements . 37
11.2 MMS Authentication value . 39
11.2.1 General . 39
11.2.2 MMS-Authentication value data type . 39
11.2.3 Handling of the association request (AARQ-apdu) . 40
11.2.4 Handling of the association result (AARE-apdu) . 40
12 End-to-end application security model . 41
12.1 Introduction and general architecture . 41
12.2 Abstract syntax specifications . 42
12.2.1 General . 42
13 End-to-end application security (normative) . 43
13.1 Association management . 43
13.1.1 General concept . 43
13.1.2 UTC time specification . 43
13.1.3 Handshake request . 43

---------------------- Page: 9 ----------------------

SIST EN IEC 62351-4:2019
– 4 – IEC 62351-4:2018 © IEC 2018
13.1.4 Handshake accept . 44
13.1.5 Association reject by the protected protocol . 45
13.1.6 Association reject due to security issues. 45
13.1.7 Handshake security abort . 46
13.1.8 Data transfer security abort . 46
13.1.9 Abort by protected protocol . 46
13.1.10 Association release request . 47
13.1.11 Association release response . 47
13.2 Data transfer phase . 47
13.2.1 General . 47
13.2.2 Clear data transfer . 48
13.2.3 Encrypted data transfer . 48
13.3 ClearToken data types . 49
13.3.1 The ClearToken1 data type . 49
13.3.2 The ClearToken2 data type . 53
13.3.3 The ClearToken3 data type . 54
13.4 Authentication and integrity specifications . 55
13.4.1 The Signature data type . 55
13.4.2 The authenticator data type . 55
14 E2E security error handling (normative) . 56
14.1 General . 56
14.2 Specification of diagnostics . 56
14.2.1 Handshake diagnostics . 56
14.2.2 The data transfer diagnostics . 57
14.3 Checking of E2E-security handshake request and accept . 58
14.3.1 General . 58
14.3.2 Signature checking . 58
14.3.3 Protected protocol identity checking . 59
14.3.4 ClearToken1 checking . 59
14.4 Checking of security protocol control information during data transfer . 60
14.4.1 General . 60
14.4.2 Authenticator checking . 60
14.4.3 Checks of the ClearToken2 value . 60
15 E2E security used in an OSI operational environment . 61
15.1 General . 61
15.2 Additional upper layer requirements . 61
15.2.1 Additional presentation layer requirements . 61
15.2.2 Additional ACSE requirements . 61
15.3 Association management in an OSI operational environment . 62
15.3.1 General . 62
15.3.2 Mapping to ACSE association request . 62
15.3.3 Mapping to ACSE association response . 62
15.3.4 Mapping to ACSE abort . 63
15.3.5 Mapping to ACSE release request . 64
15.3.6 Mapping to ACSE release response . 64
15.4 Data transfer in OSI operational environment . 64
15.4.1 General . 64
15.4.2 Mapping of the clear data transfer SecPDU . 64
15.4.3 Mapping of the encrypted data transfer SecPDU . 65

---------------------- Page: 10 ----------------------

SIST EN IEC 62351-4:2019
IEC 62351-4:2018 © IEC 2018 – 5 –
15.5 OSI upper layer routing . 65
15.6 OSI operational environment checking . 66
15.6.1 General checking . 66
15.6.2 Environment mapping checking . 66
15.6.3 OSI operational environment diagnostics . 67
16 E2E security used in in an XMPP operational environment . 67
16.1 General on wrapping to an XMPP operational environment . 67
16.2 Mapping of SecPDUs to iq stanzas . 68
16.3 Mapping of SecPDUs to message stanzas . 69
16.4 XMPP stanza error handling . 69
16.5 XML namespaces . 70
16.6 Encoding of EnvPDUs within XMPP stanzas . 70
16.7 Multiple associations . 71
16.8 Release collision consideration . 71
17 Conformance to this document . 71
17.1 General . 71
17.2 Notation . 71
17.3 Conformance to operational environment . 71
17.4 Conformance to modes of operation . 72
17.5 Conformance to compatibility mode . 72
17.6 Conformance to native mode . 73
Annex A (normative) Formal ASN.1 specification for the A-security-profile . 75
Annex B (normative) Formal ASN.1 specification for the End-to-End security. 76
Annex C (normative) Formal W3C XSD specification for the end-to-end security . 82
Annex D (normative) ASN.1 module for OSI operational environment . 89
D.1 Scope of annex . 89
D.2 ASN.1 module . 89
Annex E (normat
...

SLOVENSKI STANDARD
oSIST prEN 62351-4:2017
01-september-2017
8SUDYOMDQMHHOHNWURHQHUJHWVNHJDVLVWHPDLQSULSDGDMRþDL]PHQMDYDLQIRUPDFLM
9DUQRVWSRGDWNRYLQNRPXQLNDFLMGHO3URILOLYNOMXþQR]006
Power systems management and associated information exchange - Data and
communications security - Part 4: Profiles including MMS
Ta slovenski standard je istoveten z: prEN 62351-4:2017
ICS:
29.240.30 Krmilna oprema za Control equipment for electric
elektroenergetske sisteme power systems
35.240.50 Uporabniške rešitve IT v IT applications in industry
industriji
oSIST prEN 62351-4:2017 en
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

---------------------- Page: 1 ----------------------
oSIST prEN 62351-4:2017

---------------------- Page: 2 ----------------------
oSIST prEN 62351-4:2017
57/1860/CDV

COMMITTEE DRAFT FOR VOTE (CDV)
PROJECT NUMBER:
IEC 62351-4 ED1
DATE OF CIRCULATION: CLOSING DATE FOR VOTING:
2017-05-19 2017-08-11
SUPERSEDES DOCUMENTS:
57/1476/RR

IEC TC 57 : POWER SYSTEMS MANAGEMENT AND ASSOCIATED INFORMATION EXCHANGE
SECRETARIAT: SECRETARY:
Germany Mr Heiko Englert
OF INTEREST TO THE FOLLOWING COMMITTEES: PROPOSED HORIZONTAL STANDARD:


Other TC/SCs are requested to indicate their interest, if any, in
this CDV to the secretary.
FUNCTIONS CONCERNED:

EMC ENVIRONMENT QUALITY ASSURANCE SAFETY
SUBMITTED FOR CENELEC PARALLEL VOTING NOT SUBMITTED FOR CENELEC PARALLEL VOTING
Attention IEC-CENELEC parallel voting
The attention of IEC National Committees, members of CENELEC,
is drawn to the fact that this Committee Draft for Vote (CDV) is
submitted for parallel voting.
The CENELEC members are invited to vote through the CENELEC
online voting system.

This document is still under study and subject to change. It should not be used for reference purposes.
Recipients of this document are invited to submit, with their comments, notification of any relevant patent rights of which they are aware
and to provide supporting documentation.

TITLE:
Power systems management and associated information exchange - Data and communications security - Part 4:
Profiles including MMS

NOTE FROM TC/SC OFFICERS:
This project was originally intended to be circulated as a CD (see 57/1476/RR) . After further considerations between the
WG, the project leader and the TC 57 secretariat it has been agreed to rather issue a CDV. The existing publication IEC
TS 62351-4 Edition 1 will be cancelled and replaced once the present document is published as an international standard.
1
Copyright © 2017 International Electrotechnical Commission, IEC. All rights reserved. It is permitted to download this
electronic file, to make a copy and to print out the content for the sole purpose of preparing National Committee positions.
You may not copy or "mirror" the file or printed version of the document, or any part of it, for any other purpose without
permission in writing from IEC.

---------------------- Page: 3 ----------------------
oSIST prEN 62351-4:2017
IEC CDV 62351-4  IEC 2017 – i –
Document history
Any person intervening in the present document is invited to complete the table below before sending
the document elsewhere. The purpose is to allow all actors to see all changes introduced and the
intervening persons.
Any important message to IEC editors should also be included in the table below.
Name of
Document received Brief description of the Document sent
intervening changes introduced

person
From Date To Date
Erik  Base document Steffen 8 July
Andersen Fries 2016
Erik 8 July Updates and comments, including Erik An- 12 July
Steffen Fries
Andersen 2016 TLS dersen 2016
Erik Steffen 12 July Further editing and proof reading Steffen 16 Oct.
Andersen Fries 2016 Fries 2016
Steffen Fries Erik 16 Oct. Clean-up the TLS Erik An- 1
Andersen 2016 dersen Novem-
ber
Erik Steffen 1 Novem- Complete rework of text Steffen 1
Andersen Fries ber, 2016 Fries March
2017
Steffen Fries Erik 1 March, Solutions for open questions in TLS Erik An- 3
Andersen 2017 section, general review comments dersen March
and enhancements 2017
M. Noeth E. 2017-03- CD document CO 2017-
Anderson 14 03-15

---------------------- Page: 4 ----------------------
oSIST prEN 62351-4:2017
– ii – IEC CDV 62351-4  IEC 2017
Table of Content
FOREWORD . 1
SECTION 1 – GENERAL . 3
1 Scope and object . 3
1.1 Scope . 3
1.2 Object . 3
2 Normative references . 3
3 Terms, definitions and abbreviations. 5
3.1 Defined terms and definitions . 5
3.2 Additional definitions . 5
3.3 Defined abbreviations . 7
3.4 Additional abbreviations . 7
4 Security issues addressed by this part of IEC 62315 . 8
4.1 Security for application and transport profiles . 8
4.2 Security threats countered . 8
4.3 Attack methods countered . 8
4.4 Logging . 9
5 Bilateral Agreements . 9
SECTION 2 – T-PROFILE. 11
6 T-profile security . 11
6.1 General . 11
6.2 Use of Transport Layer Security (TLS) . 11
6.2.1 Disabling of TLS . 12
6.2.2 TLS cipher suites support . 12
6.2.3 TLS session resumption . 13
6.2.4 Individual public-key certificate components . 13
6.2.5 Supported number of Certification Authorities . 13
6.2.6 TCP ports . 13
6.2.7 Public-key certificate size . 13
6.2.8 Evaluation period for revocation state of public-key certificates . 14
6.2.9 Public-key certificate validation . 14
6.2.10 Security events handling . 14
SECTION 3 – APPLICATION SECURITY PROFILES OVERVIEW . 15
7 Application security profile overview (informative) . 15
8 Use of cryptographic algorithms (informative) . 15
8.1 Basic cryptographic definitions . 15
8.2 Public-key algorithms . 16
8.3 Signature algorithms . 16
8.4 Symmetric encryption algorithms used for encryption only . 17
8.5 Authenticating encryption algorithms . 17
8.6 Integrity check value algorithms . 18
9 Object identifier allocation (normative) . 18
10 General OSI upper layer requirements (normative) . 19
10.1 Overview . 19
10.2 General on OSI upper layer requirements . 19
10.3 Session protocol requirements . 20
10.4 Presentation protocol requirements . 20
10.4.1 Context list . 20

---------------------- Page: 5 ----------------------
oSIST prEN 62351-4:2017
IEC CDV 62351-4  IEC 2017 – iii –
10.4.2 Abstract syntaxes . 20
10.4.3 Presentation user data . 21
10.4.4 ASN.1 encoding requirements . 21
10.5 Association control service element (ACSE) protocol requirements . 21
10.5.1 Protocol version . 21
10.5.2 Titles . 21
10.5.3 Use of ASN.1 EXTERNAL data type . 22
SECTION 4 – MMS A-SECURITY-PROFILE . 22
11 OSI requirements specific to A-security profile (normative) . 22
11.1 Introduction . 22
11.2 Presentation protocol requirement . 23
11.3 ACSE requirements . 23
11.3.1 Functional unit selection . 23
11.3.2 Application context . 23
11.3.3 Authentication mechanism . 23
11.3.4 Authentication value . 23
12 MMS Authentication value (normative) . 24
12.1 MMS-Authentication value data type . 24
12.2 Handling of the association request (AARQ-apdu) . 24
12.2.1 AARQ-apdu handling by the client . 24
12.2.2 AARQ-apdu handling by the server . 25
12.3 Handling of the association result (AARE-apdu) . 25
12.3.1 AARE-apdu handling by the server . 25
12.3.2 AARE-apdu handling by the client . 25
SECTION 5 – END-TO-END APPLICATION SECURITY PROFILES . 26
13 Overview and overall principles . 26
13.1 Basic concepts . 26
13.2 Relationship between E2E-security and the protected application protocol . 26
13.3 E2E-security interface to protected application protocol . 27
13.3.1 General . 27
13.3.2 ASN.1 as schema definition . 27
13.3.3 XML Schema Definition (XSD) . 28
14 Specific requirements for an OSI environment . 28
14.1 Introduction . 28
14.2 Additional presentation layer requirements . 29
14.3 Additional ACSE requirements . 29
14.4 Specific OSI related protocol elements . 29
14.4.1 OSI wrapping for E2E-security handshake . 29
14.4.2 OSI wrapping for E2E-security data transfer . 30
15 Association management . 30
15.1 General concept . 30
15.2 General syntax . 30
15.3 Handshake request and accept . 30
15.3.1 General . 30
15.3.2 OSI specific considerations . 31
15.3.3 NON-OSI specific considerations . 31
15.4 Association reject by the protected application protocol . 31
15.4.1 General . 31
15.4.2 OSI specific considerations . 32

---------------------- Page: 6 ----------------------
oSIST prEN 62351-4:2017
– iv – IEC CDV 62351-4  IEC 2017
15.4.3 NON-OSI specific considerations . 32
15.5 Association reject due to security issues . 32
15.5.1 General . 32
15.5.2 OSI specific considerations . 32
15.5.3 Non-OSI specific considerations . 33
15.6 Data transfer security abort . 33
15.6.1 General syntax . 33
15.6.2 OSI specific considerations . 33
15.6.3 Non-OSI specific considerations . 33
16 Data transfer phase . 33
16.1 Normal data transfer . 33
16.1.1 General syntax . 33
16.1.2 OSI specific considerations . 34
16.1.3 Non-OSI specific considerations . 34
16.2 Abort by protected application protocol. 34
16.2.1 General . 34
16.2.2 OSI specific considerations . 34
16.2.3 Non-OSI specific considerations . 34
17 ClearToken data types . 34
17.1 The ClearToken1 data type . 34
17.1.1 General syntax . 34
17.1.2 Supported signature algorithms . 35
17.1.3 Diffie-Hellman set . 36
17.1.4 Shared keys derivation . 36
17.1.5 Confidentiality parameters . 37
17.1.6 Certification path . 37
17.1.7 Supported integrity algorithms . 38
17.2 The ClearToken2 data type . 38
17.3 The ClearToken3 data type . 39
18 Authentication and integrity specifications . 39
18.1 The Signature data type . 39
18.2 The authenticator data type . 39
19 E2E-security error handling . 40
19.1 Handshake diagnostics . 40
19.2 The data transfer diagnostics . 41
20 Procedure for checking association request (normative) . 42
20.1 E2E-security carrier checking . 42
20.1.1 E2E-security carrier checking within an OSI environment . 42
20.1.2 E2E-security carrier checking within a non-OSI environment . 42
20.2 Checking of E2E-security handshake request . 42
20.2.1 E2E-security handshake request in an OSI environment . 42
20.2.2 General checking of E2E-security Handshake request . 43
21 Procedure for checking association result (normative) . 43
21.1 E2E-security carrier checking . 44
21.1.1 E2E-security carrier checking within an OSI environment . 44
21.1.2 E2E-security carrier checking within a non-OSI environment . 44
21.2 Specific checking of E2E-security handshake result . 44
21.2.1 E2E-security handshake in an OSI environment . 44
22 Checking of security parameters during data transfer . 44

---------------------- Page: 7 ----------------------
oSIST prEN 62351-4:2017
IEC CDV 62351-4  IEC 2017 – v –
22.1 Checking within an OSI environment . 44
22.2 Checking within a non-OSI environment . 44
22.3 Common checking . 45
22.3.1 Overall checking . 45
22.3.2 Authenticator checking . 45
22.3.3 Checks of the ClearToken2 value . 45
23 Application layer routing . 45
23.1 General on application layer routing . 45
23.2 Application layer routing in an OSI environment . 46
23.3 Application layer routing in a non-OSI environment . 46
24 Conformance to this part of IEC 62351 . 47
24.1 General . 47
24.2 T-Profile Conformance . 47
24.3 A-Profile Conformance . 47
24.4 Conformance of IEC 60870-6 TASE.2 Security . 47
Annex A (normative) Formal ASN.1 specification for the A-security profile . 48
Annex B (normative) Formal ASN.1 specification for the End-to-End security . 49
Annex C (normative) Formal XSD specification for the End-to-End security . 55
Annex D (normative) End-entity public-key certificate specification . 60
D.1 Scope of annex . 60
D.2 General requirement . 60
D.3 Specific OSI application considerations . 60
D.4 Basic Structure requirement and recommendations . 60
D.4.1 Version component . 60
D.4.2 Serial number component . 60
D.4.3 Issuer signature algorithm component . 60
D.4.4 Issuer component . 61
D.4.5 Validity component . 61
D.4.6 Subject component . 61
D.4.7 Subject public key Information component . 61
D.4.8 Issuer unique ID and subject unique ID components . 61
D.5 Extensions . 61
D.5.1 Key usage extension . 62
D.5.2 Subject alternative name extension . 62
D.5.3 Revocation checking . 62
D.5.4 IEC user role information extension . 62
Annex E (normative) Lower layer requirements . 63
E.1 Scope of annex . 63
E.2 Transport protocol class 0 . 63
E.2.1 Enforcement of maximum lengths . 63
E.2.2 Response to Class 0 unsupported TPDUs . 63
E.2.3 Transport selectors . 63
E.3 IETF RFC 1006 . 63
E.3.1 Version number . 63
E.3.2 Length . 64
E.3.3 Keep-alive . 64
Annex F (informative) ASN.1 definition of ACSE. 65
Bibliography . 69

---------------------- Page: 8 ----------------------
oSIST prEN 62351-4:2017
IEC CDV 62351-4  IEC 2017 – 1 –
1 INTERNATIONAL ELECTROTECHNICAL COMMISSION
2 ____________
3
4 POWER SYSTEMS MANAGEMENT AND ASSOCIATED INFORMATION
5 EXCHANGE – DATA AND COMMUNICATIONS SECURITY –
6
7 Part 4: Profiles including MMS and derivatives
8
9 FOREWORD
10 1) The International Electrotechnical Commission (IEC) is a worldwide organization for standardization comprising
11 all national electrotechnical committees (IEC National Committees). The object of IEC is to promote
12 international co-operation on all questions concerning standardization in the electrical and electronic fields. To
13 this end and in addition to other activities, IEC publishes International Standards, Technical Specifications,
14 Technical Reports, Publicly Available Specifications (PAS) and Guides (hereafter referred to as “IEC
15 Publication(s)”). Their preparation is entrusted to technical committees; any IEC National Committee interested
16 in the subject dealt with may participate in this preparatory work. International, governmental and non-
17 governmental organizations liaising with the IEC also participate in this preparation. IEC collaborates closely
18 with the International Organization for Standardization (ISO) in accordance with conditions determined by
19 agreement between the two organizations.
20 2) The formal decisions or agreements of IEC on technical matters express, as nearly as possible, an international
21 consensus of opinion on the relevant subjects since each technical committee has representation from all
22 interested IEC National Committees.
23 3) IEC Publications have the form of recommendations for international use and are accepted by IEC National
24 Committees in that sense. While all reasonable efforts are made to ensure that the technical content of IEC
25 Publications is accurate, IEC cannot be held responsible for the way in which they are used or for any
26 misinterpretation by any end user.
27 4) In order to promote international uniformity, IEC National Committees undertake to apply IEC Publications
28 transparently to the maximum extent possible in their national and regional publications. Any divergence
29 between any IEC Publication and the corresponding national or regional publication shall be clearly indicated in
30 the latter.
31 5) IEC itself does not provide any attestation of conformity. Independent certification bodies provide conformity
32 assessment services and, in some areas, access to IEC marks of conformity. IEC is not responsible for any
33 services carried out by independent certification bodies.
34 6) All users should ensure that they have the latest edition of this publication.
35 7) No liability shall attach to IEC or its directors, employees, servants or agents including individual experts and
36 members of its technical committees and IEC National Committees for any personal injury, property damage or
37 other damage of any nature whatsoever, whether direct or indirect, or for costs (including
...