IEC 62351-3-ed.2.0

Detail information

Designation: IEC 62351-3-ed.2.0

Publication date: 06/06/2023

Pages: 0

Country: International technical standard

Where to buy?

You can buy at www.mystandards.biz

Anotation

IEC 62351-3:2023 specifies how to provide confidentiality, integrity protection, and message level authentication for protocols that make use of TCP/IP as a message transport layer and utilize Transport Layer Security when cyber-security is required. This may relate to SCADA and telecontrol protocols, but also to additional protocols if they meet the requirements in this document. IEC 62351-3 specifies how to secure TCP/IP-based protocols through constraints on the specification of the messages, procedures, and algorithms of Transport Layer Security (TLS) (TLSv1.2 defined in RFC 5246, TLSv1.3 defined in RFC 8446). In the specific clauses, there will be subclauses to note the differences and commonalities in the application depending on the target TLS version. The use and specification of intervening external security devices (e.g., "bump-in-the-wire") are considered out-of-scope. In contrast to previous editions of this document, this edition is self-contained in terms of completely defining a profile of TLS. Hence, it can be applied directly, without the need to specify further TLS parameters, except the port number, over which the communication will be performed. Therefore, this part can be directly utilized from a referencing standard and can be combined with further security measures on other layers. Providing the profiling of TLS without the need for further specifying TLS parameters allows declaring conformity to the described functionality without the need to involve further IEC 62351 documents. This document is intended to be referenced as a normative part of other IEC standards that have the need for providing security for their TCP/IP-based protocol exchanges under similar boundary conditions. However, it is up to the individual protocol security initiatives to decide if this document is to be referenced. The document also defines security events for specific conditions, which support error handling, security audit trails, intrusion detection, and conformance testing. Any action of an organization in response to events to an error condition described in this document are beyond the scope of this document and are expected to be defined by the organization’s security policy. This document reflects the security requirements of the IEC power systems management protocols. Should other standards bring forward new requirements, this document may need to be revised. This second edition cancels and replaces the first edition published in 2014, Amendment 1:2018 and Amendment 2:2020. This edition constitutes a technical revision. This edition includes the following significant technical changes with respect to the previous edition: a) Inclusion of the TLSv1.2 related parameter required in IEC 62351-3 Ed.1.2 to be specified by the referencing standard. This comprises the following parameter: • Mandatory TLSv1.2 cipher suites to be supported. • Specification of session resumption parameters. • Specification of session renegotiation parameters. • Revocation handling using CRL and OCSP. • Handling of security events. b) Inclusion of a TLSv1.3 profile to be applicable for the power system domain in a similar way as for TLSv1.2 session. IEC 62351-3:2023 specifie comment assurer la confidentialite, la protection de l’integrite et l’authentification des niveaux des messages pour les protocoles qui utilisent les protocoles TCP/IP comme couche transport des messages et utilisent la securite de la couche transport lorsque la cybersecurite est exigee. Ceci peut concerner les protocoles SCADA/teleconduite, protection, automation et controles. L’IEC 62351-3 specifie une methode permettant de securiser les protocoles TCP/IP par l’intermediaire de contraintes sur la specification des messages, procedures et algorithmes de securite de la couche transport (TLS) (version 1.2 de TLS definie dans la RFC 5246 et version 1.3 definie dans la RFC 8446). Des articles specifiques contiennent des paragraphes indiquant les differences et les points communs d’application en fonction de la version TLS cible. L’utilisation et la specification des dispositifs de securite externe concernes (par exemple "bump-in-the-wire") sont considerees comme ne relevant pas du domaine d’application du present document. Contrairement aux precedentes editions du present document, la presente edition est autosuffisante, car elle definit entierement un profil de TLS. De ce fait, elle peut etre appliquee directement, sans necessiter de specifier de parametres TLS supplementaires, a l’exception du numero du port par lequel la communication est effectuee. Par consequent, la presente partie peut etre directement utilisee a partir d’une norme de reference et peut etre combinee avec des mesures de securite supplementaires sur d’autres couches. La definition du profil de TLS sans necessiter de specifier de parametres TLS supplementaires permet de declarer la conformite a la fonctionnalite decrite sans necessiter de recourir a d’autres documents IEC 62351. Le present document est destine a etre reference comme partie normative des autres normes IEC qui traitent de la necessite d’assurer la securite de leurs echanges protocolaires bases sur TCP/IP dans des conditions limites similaires. Cependant, il revient aux initiatives individuelles en matiere de securite des protocoles de decider si le present document est a referencer. Le present document definit egalement des evenements de securite pour des conditions specifiques, qui prennent en charge la gestion des erreurs, les pistes d’audit de securite, la detection d’intrusion et les essais de conformite. Toute action d’un organisme en reponse a des evenements dus a une condition d’erreur decrite dans le present document ne releve pas du domaine d’application du present document et est susceptible d’etre definie par la politique de securite de l’organisme. Le present document presente les exigences de securite des protocoles de gestion des systemes de puissance de l’IEC. Une revision du present docume