iTeh StandardsiTeh Standards
EURUSD
Your shopping cart is empty.
IEC

IEC TR 62351-90-3:2021

(Main)

Power systems management and associated information exchange - Data and communications security - Part 90-3: Guidelines for network and system management

Power systems management and associated information exchange - Data and communications security - Part 90-3: Guidelines for network and system management

IEC TR 62351-90-3:2021, which is a technical report, provides guidelines for efficiently handling both IT and OT data in terms of their monitoring, classification and correlations on them to deduce any possible useful outcomes about the state of the power system.
The convergence of information technologies (IT) and operational technologies (OT) refers to the integration of the systems, processes and data associated with the domains of IT and OT. This document provides guidelines for a comprehensive security monitoring for power grid components based on IT/OT convergent systems. The emphasis is about the development of a methodology and a set of recommendations for utility operators to build a general monitoring framework based on the analysis of the data collected from different IT and OT systems through network management, traffic inspection, and system activity readings. As such, the monitoring framework that this document introduces relies on the integration of management and logging information obtained using IEC 62351-7 and IEC 62351-14, respectively. Further systems and data sources from IT and OT would be considered such as the data obtained, for instance, through the IT network management using the Simple Network Management Protocol (SNMP), the passive network monitoring, and the functional characterization of control and automation processes.
This document's recommendations include the implementation of data collection, filtering and correlation mechanisms. The development of data analytics algorithms is out of the scope of this document and would be left to utility operators and owners. Finally, applications of the general monitoring framework guidelines and recommendations are provided for different power grid environments, namely for IEC 61850 substations and for Distributed Energy Resources (DER) systems.

General Information

Status
Published
Publication Date
10-Mar-2021
ICS
33.200 - Telecontrol. Telemetering
Technical Committee
TC 57 - Power systems management and associated information exchange
Current Stage
PPUB - Publication issued
Start Date
08-Apr-2021
Completion Date
11-Mar-2021
Ref Project

Buy Standard

IEC TR 62351-90-3:2021 - Power systems management and associated information exchange - Data and communications security - Part 90-3: Guidelines for network and system managementIEC TR 62351-90-3:2021 - Power systems management and associated information exchange - Data and communications security - Part 90-3: Guidelines for network and system management
PreviousNext
Technical report
IEC TR 62351-90-3:2021 - Power systems management and associated information exchange - Data and communications security - Part 90-3: Guidelines for network and system management
English language
23 pages
sale 15% off
Preview
sale 15% off
Preview

Standards Content (Sample)

IEC TR 62351-90-3
®

Edition 1.0 2021-03
TECHNICAL
REPORT

colour
inside


Power systems management and associated information exchange – Data and
communications security –
Part 90-3: Guidelines for network and system management

IEC TR 62351-90-3:2021-03(en)

---------------------- Page: 1 ----------------------
THIS PUBLICATION IS COPYRIGHT PROTECTED
Copyright © 2021 IEC, Geneva, Switzerland

All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized in any form
or by any means, electronic or mechanical, including photocopying and microfilm, without permission in writing from
either IEC or IEC's member National Committee in the country of the requester. If you have any questions about IEC
copyright or have an enquiry about obtaining additional rights to this publication, please contact the address below or
your local IEC member National Committee for further information.


IEC Central Office Tel.: +41 22 919 02 11
3, rue de Varembé info@iec.ch
CH-1211 Geneva 20 www.iec.ch
Switzerland

About the IEC
The International Electrotechnical Commission (IEC) is the leading global organization that prepares and publishes
International Standards for all electrical, electronic and related technologies.

About IEC publications
The technical content of IEC publications is kept under constant review by the IEC. Please make sure that you have the
latest edition, a corrigendum or an amendment might have been published.

IEC publications search - webstore.iec.ch/advsearchform IEC online collection - oc.iec.ch
The advanced search enables to find IEC publications by a Discover our powerful search engine and read freely all the
variety of criteria (reference number, text, technical publications previews. With a subscription you will always
committee, …). It also gives information on projects, replaced have access to up to date content tailored to your needs.
and withdrawn publications.

Electropedia - www.electropedia.org
IEC Just Published - webstore.iec.ch/justpublished
The world's leading online dictionary on electrotechnology,
Stay up to date on all new IEC publications. Just Published
containing more than 22 000 terminological entries in English
details all new publications released. Available online and
and French, with equivalent terms in 18 additional languages.
once a month by email.
Also known as the International Electrotechnical Vocabulary

(IEV) online.
IEC Customer Service Centre - webstore.iec.ch/csc

If you wish to give us your feedback on this publication or
need further assistance, please contact the Customer Service
Centre: sales@iec.ch.

---------------------- Page: 2 ----------------------
IEC TR 62351-90-3

®


Edition 1.0 2021-03




TECHNICAL



REPORT








colour

inside










Power systems management and associated information exchange – Data and

communications security –

Part 90-3: Guidelines for network and system management

























INTERNATIONAL

ELECTROTECHNICAL


COMMISSION





ICS 33.200 ISBN 978-2-8322-9529-8




  Warning! Make sure that you obtained this publication from an authorized distributor.


® Registered trademark of the International Electrotechnical Commission

---------------------- Page: 3 ----------------------
– 2 – IEC TR 62351-90-3:2021 © IEC 2021
CONTENTS
FOREWORD . 3
1 Scope . 5
2 Normative references . 5
3 Terms and definitions . 6
4 Abbreviated terms and acronyms . 6
5 Information collection, filtering and processing . 7
5.1 IT/OT elements . 7
5.2 Network and system monitoring tools . 8
5.2.1 SNMP monitoring agents . 8
5.2.2 IDS/IPS probes . 8
5.2.3 Network and system management central platforms . 9
5.3 Log management tools . 10
5.3.1 Log collection architecture .
...

Questions, Comments and Discussion

Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.

This May Also Interest You

IEC
IEC TS 62351-100-4:2023(Main)
Power systems management and associated information exchange - Data and communication security - Part 100-4: Cybersecurity conformance testing for IEC 62351-4

IEC TS 62351-100-4:2023, which is a technical specification, describes test procedures for interoperability conformance testing of data and communication security for power system automation and protection systems which implement MMS, IEC 61850-8-1 (MMS), IEC 61850-8-2 (XMPP) or any other protocol implementing IEC 62351-4:2018/AMD1:2020. The tests described in this document cover only E2E security testing and do not evaluate A-security profile implementation. Thus, citing conformance to this document does not imply that any particular security level has been achieved by the corresponding product, or by the system in which it is used.
The goal of this document is to enable interoperability by providing a standard method of testing protocol implementations, but it does not guarantee the full interoperability of devices. It is expected that using this document during testing will minimize the risk of non interoperability. Additional testing and assurance measures will be required to verify that a particular implementation of IEC 62351-4:2018/AMD1:2020 has correctly implemented all the security functions and that they can be assured to be present in the delivered products. This topic is covered in other IEC standards, for example IEC 62443.
The scope of this document is to specify available common procedures and definitions for conformance and/or interoperability testing of IEC 62351-4:2018/AMD1:2020.
This document deals mainly with cyber security conformance testing; therefore, other requirements, such as safety or EMC are not covered. These requirements are covered by other standards (if applicable) and the proof of compliance for these topics is done according to these standards.
T-profile testing is to be performed prior to E2E security profile testing. T-profile testing is described in IEC 62351-100-3 in the context of IEC 61850-8-1. T-profile testing for IEC 61850-8-2 is to be described in the corresponding IEC 61850-8-2 test specification.

  • Technical specification
    109 pages
    English language
    sale 15% off
IEC
IEC 60870-5-104:2006/AMD1:2016/COR1:2023(Amendment)
Corrigendum 1 - Amendment 1 - Telecontrol equipment and systems - Part 5-104: Transmission protocols - Network access for IEC 60870-5-101 using standard transport profiles
  • Standard
    1 page
    English and French language
    sale 15% off
IEC
IEC TR 61850-90-7:2023(Main)
Communication networks and systems for power utility automation - Part 90-7: Object models for power converters in distributed energy resources (DER) systems

IEC TR 61850-90-7:2023 is available as IEC TR 61850-90-7:2023 RLV which contains the International Standard and its Redline version, showing all changes of the technical content compared to the previous edition.IEC TR 61850-90-7:2023, which is a Technical Report, describes functions for power converter-based distributed energy resources (DER) systems, focused on DC-to-AC and AC-to-AC conversions and including photovoltaic systems (PV), battery storage systems, electric vehicle (EV) charging systems, and any other DER systems with a controllable power converter. The functions defined in this document were used to help define the information models described in IEC 61850-7-420 and which can be used in the exchange of information between these power converter-based DER systems and the utilities, energy service providers (ESPs), or other entities which are tasked with managing the volt, var, and watt capabilities of these power converter-based systems. These power converter-based DER systems can range from very small grid-connected systems at residential customer sites, to medium-sized systems configured as microgrids on campuses or communities, to very large systems in utility-operated power plants, and to many other configurations and ownership models. They may or may not combine different types of DER systems behind the power converter, such as a power converter-based DER system and a battery that are connected at the DC level. This second edition cancels and replaces the first edition published in 2013. This edition is primarily an editorial revision in order to be consistent with the publication of Edition 2 of IEC 61850-7-420:2021. This edition includes the following significant changes with respect to the previous edition:
a) Clause 3 has been updated.
b) Clause 8 (IEC 61850 information models for power converter-based functions) has been deleted. This clause defined data models with the transitional namespace “(Tr) IEC 61850-90-7:2012”. The data models are now defined in IEC 61850-7-420.

  • Technical report
    163 pages
    English language
    sale 15% off
IEC
IEC TR 61850-90-27:2023(Main)
Communication networks and systems for power utility automation - Part 90-27: Use of IEC 61850 for thermal energy systems connected to electric power grid

IEC TR 61850-90-27:2023, which is a Technical Report, is to provide basic aspects that need to be considered when using IEC 61850 for information exchange between systems and components to support applications for thermal systems connected to electric power networks. Thermal systems isolated from electric power networks are outside the scope of this document.
From the perspective of category, this document considers thermal systems that provide thermal energy services for residential and/or commercial buildings and districts. In other words, industrial thermal systems are outside the scope of this document.
From the perspective of energy transformation, this document deals with ones between electricity and thermal energy. Other types of energy such as gas will be documented in a future report.
From the perspective of resource, this document considers generic aspects of thermal energy generators, storage, and loads that may contribute to the operations and management of electric power networks. It also deals with specific types of resources that have electric parts such as power to heat (P2H) that is a kind of electric load, and combined heat and power (CHP) that is an electric generator. This document models the characteristics for such specific units of resources including alarms and ratings. On the other hand, it does not deal with other types of specific units according to the scope of this document. For example, gas boilers, thermal energy tanks, heat exchangers, HVAC, auxiliary devices for thermal systems are not modelled as logical nodes in this document.
As a summary, this document
- gives an overview of thermal energy resources connected to electric power networks.
- provides use cases for typical operations of thermal system and deducts exchanged information necessary for information modelling.
- provides mapping of requirements on LNs based on the use cases.
- defines generic logical nodes for resources in thermal systems.
- defines logical nodes for specific unit types of P2H and CHP.
- defines logical nodes for operations that may contribute to the operations of electric power networks.

  • Technical report
    180 pages
    English language
    sale 15% off
IEC
IEC 62351-3:2023(Main)
Power systems management and associated information exchange - Data and communications security - Part 3: Communication network and system security - Profiles including TCP/IP

IEC 62351-3:2023 specifies how to provide confidentiality, integrity protection, and message level authentication for protocols that make use of TCP/IP as a message transport layer and utilize Transport Layer Security when cyber-security is required. This may relate to SCADA and telecontrol protocols, but also to additional protocols if they meet the requirements in this document.
IEC 62351-3 specifies how to secure TCP/IP-based protocols through constraints on the specification of the messages, procedures, and algorithms of Transport Layer Security (TLS) (TLSv1.2 defined in RFC 5246, TLSv1.3 defined in RFC 8446). In the specific clauses, there will be subclauses to note the differences and commonalities in the application depending on the target TLS version. The use and specification of intervening external security devices (e.g., "bump-in-the-wire") are considered out-of-scope.
In contrast to previous editions of this document, this edition is self-contained in terms of completely defining a profile of TLS. Hence, it can be applied directly, without the need to specify further TLS parameters, except the port number, over which the communication will be performed. Therefore, this part can be directly utilized from a referencing standard and can be combined with further security measures on other layers. Providing the profiling of TLS without the need for further specifying TLS parameters allows declaring conformity to the described functionality without the need to involve further IEC 62351 documents.
This document is intended to be referenced as a normative part of other IEC standards that have the need for providing security for their TCP/IP-based protocol exchanges under similar boundary conditions. However, it is up to the individual protocol security initiatives to decide if this document is to be referenced.
The document also defines security events for specific conditions, which support error handling, security audit trails, intrusion detection, and conformance testing. Any action of an organization in response to events to an error condition described in this document are beyond the scope of this document and are expected to be defined by the organization’s security policy.
This document reflects the security requirements of the IEC power systems management protocols. Should other standards bring forward new requirements, this document may need to be revised.
This second edition cancels and replaces the first edition published in 2014, Amendment 1:2018 and Amendment 2:2020. This edition constitutes a technical revision.
This edition includes the following significant technical changes with respect to the previous edition:
a) Inclusion of the TLSv1.2 related parameter required in IEC 62351-3 Ed.1.2 to be specified by the referencing standard. This comprises the following parameter:
• Mandatory TLSv1.2 cipher suites to be supported.
• Specification of session resumption parameters.
• Specification of session renegotiation parameters.
• Revocation handling using CRL and OCSP.
• Handling of security events.
b) Inclusion of a TLSv1.3 profile to be applicable for the power system domain in a similar way as for TLSv1.2 session.

  • Standard
    103 pages
    English and French language
    sale 15% off
IEC
IEC 62351-9:2023(Main)
Power systems management and associated information exchange - Data and communications security - Part 9: Cyber security key management for power system equipment

IEC 62351-9:2023 specifies cryptographic key management, primarily focused on the management of long-term keys, which are most often asymmetric key pairs, such as public-key certificates and corresponding private keys. As certificates build the base this document builds a foundation for many IEC 62351 services (see also Annex A). Symmetric key management is also considered but only with respect to session keys for group-based communication as applied in IEC 62351-6. The objective of this document is to define requirements and technologies to achieve interoperability of key management by specifying or limiting key management options to be used.
This document assumes that an organization (or group of organizations) has defined a security policy to select the type of keys and cryptographic algorithms that will be utilized, which may have to align with other standards or regulatory requirements. This document therefore specifies only the management techniques for these selected key and cryptography infrastructures. This document assumes that the reader has a basic understanding of cryptography and key management principles.
The requirements for the management of pairwise symmetric (session) keys in the context of communication protocols is specified in the parts of IEC 62351 utilizing or specifying pairwise communication such as:
• IEC 62351-3 for TLS by profiling the TLS options
• IEC 62351-4 for the application layer end-to-end security
• IEC TS 62351-5 for the application layer security mechanism for IEC 60870-5-101/104 and IEEE 1815 (DNP3)
The requirements for the management of symmetric group keys in the context of power system communication protocols is specified in IEC 62351-6 for utilizing group security to protect GOOSE and SV communication. IEC 62351-9 utilizes GDOI as already IETF specified group-based key management protocol to manage the group security parameter and enhances this protocol to carry the security parameter for GOOSE, SV, and PTP.
This document also defines security events for specific conditions which could identify issues which might require error handling. However, the actions of the organisation in response to these error conditions are beyond the scope of this document and are expected to be defined by the organizations security policy.
In the future, as public-key cryptography becomes endangered by the evolution of quantum computers, this document will also consider post-quantum cryptography to a certain extent. Note that at this time being no specific measures are provided.
This second edition cancels and replaces the first edition published in 2017. This edition constitutes a technical revision.
This edition includes the following significant technical changes with respect to the previous edition:
a) Certificate components and verification of the certificate components have been added;
b) GDOI has been updated to include findings from interop tests;
c) GDOI operation considerations have been added;
d) GDOI support for PTP (IEEE 1588) support has been added as specified by IEC/IEEE 61850-9-3 Power Profile;
e) Cyber security event logging has been added as well as the mapping to IEC 62351-14;
f) Annex B with background on utilized cryptographic algorithms and mechanisms has been added.

  • Standard
    296 pages
    English and French language
    sale 15% off
IEC
IEC 62488-2:2017/COR2:2023(Corrigendum)
Corrigendum 2 - Power line communication systems for power utility applications - Part 2: Analogue power line carrier terminals or APLC
  • Standard
    1 page
    English and French language
    sale 15% off
IEC
IEC TS 61850-7-7:2018/AMD1:2023(Amendment)
Amendment 1 - Communication networks and systems for power utility automation - Part 7-7: Machine-processable format of IEC 61850-related data models for tools
  • Technical specification
    12 pages
    English language
    sale 15% off
IEC
IEC 62351-5:2023(Main)
Power systems management and associated information exchange - Data and communications security - Part 5: Security for IEC 60870-5 and derivatives

IEC 62351-5:2023 defines the application profile (A-profile) secure communication mechanism specifying messages, procedures and algorithms for securing the operation of all protocols based on or derived from IEC 60870-5, Telecontrol Equipment and Systems – Transmission Protocols.
For the measures described in this document to take effect, they must be accepted and referenced by the specifications for the protocols themselves. This document is written to enable that process.
The subsequent audience for this document is intended to be the developers of products that implement these protocols.
Portions of this document may also be of use to managers and executives in order to understand the purpose and requirements of the work.
This document is organized working from the general to the specific, as follows:
• Clauses 2 through 4 provide background terms, definitions, and references.
• Clause 5 describes the problems this specification is intended to address.
• Clause 6 describes the mechanism generically without reference to a specific protocol.
• Clauses 7 and 8 describe the mechanism more precisely and are the primary normative part of this specification.
• Clause 9 define the interoperability requirements for this secure communication mechanism.
• Clause 10 describes the requirements for other standards referencing this document.
The actions of an organization in response to events and error conditions described in this document are expected to be defined by the organization’s security policy and they are beyond the scope of this document.
This International Standard cancels and replaces IEC TS 62351-5 published in 2013. It constitutes a technical revision. The primary changes in this International Standard are:
a) The secure communication mechanism is performed on per controlling station/controlled station association.
b) User management to add, change or delete a User, was removed.
c) Symmetric method to change the Update Key was removed.
d) Asymmetric method to the change Update Key was reviewed.
e) Challenge/Reply procedure and concepts were removed.
f) Aggressive Mode concept was replaced with the Secure Data message exchange mechanism.
g) Authenticated encryption of application data was added.
h) The list of permitted security algorithms has been updated.
i) The rules for calculating messages sequence numbers have been updated
j) Events monitoring and logging was added

  • Standard
    263 pages
    English and French language
    sale 15% off
IEC
IEC TS 62351-100-6:2022(Main)
Power systems management and associated information exchange - Data and communication security - Part 100-6: Cybersecurity conformance testing for IEC 61850-8-1 and IEC 61850-9-2

IEC TS 62351-100-6:2022 (E), which is a technical specification, is part of the IEC 62351 suite of standards, which describes test cases for interoperability conformance testing of data and communication security for Substation Automation Systems [SAS] and telecontrol systems which implement IEC TS 62351-6. The tests described in this part do not evaluate the security of the implementation. Thus, citing conformance to this part does not imply that any particular security level has been achieved by the corresponding product, or by the system in which it is used.
The goal of this part of IEC 62351 is to enable interoperability by providing a standard method of testing protocol implementations, but it does not guarantee the full interoperability of devices. It is expected that using this specification during testing will minimize the risk of non-interoperability. Additional testing and assurance measures will be required to verify that a particular implementation of IEC TC 62351-6 has correctly implemented all the security functions and that they can be assured to be present in all delivered products. This topic is covered in other IEC standards, for example IEC 62443.
The scope of this document is to specify common available procedures and definitions for conformance and/or interoperability testing of IEC 62351-6, the IEC 61850-8-1, IEC 61850-9-2 and also their recommendations over IEC 62351-3 for profiles including TCP/IP and IEC 62351 4 for profiles including MMS. These are the security extensions for IEC 61850 and derivatives to enable unambiguous and standardized evaluation of IEC TS 62351-6 and its companion standards protocol implementations.
The detailed test cases per companion standard, containing among others mandatory and optional mandatory test cases per Secure Communication Application Function, secure ASDU (Application Service Data Unit) and transmission procedures, will become available as technical specifications (TS). Other functionality may need additional test cases, but this is outside the scope of this part of IEC 62351. This document is such a technical specification for the mentioned companion standard.
This document deals mainly with data and communication security conformance testing; therefore, other requirements, such as safety or EMC (Electromagnetic compatibility) are not covered. These requirements are covered by other standards (if applicable) and the proof of compliance for these topics is done according to these standards.

  • Technical specification
    32 pages
    English language
    sale 15% off